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PREFACE 


This  document  is  the  second  of  three  volumes  which  make  up  the 
assessment  of  autonomy  for  the  DSCS  III  satellite  system.  Volume  I  is  an 
overview  and  summary  of  the  assessment;  review  of  it  is  recommended  prior  to 
reading  subsequent  Volumes.  Volume  II  (this  volume)  is  a  functional 
description  of  the  existing  DSCS  III  satellite  system  and  an  assessment  of  its 
current  autonomy.  Volume  III  presents  options,  at  the  functional  level,  for 
increasing  the  autonomy  of  DSCS  III. 

The  DSCS  III  assessment  was  performed  by  the  Autonomous  Spacecraft 
Project  Team.  Authorship  of  specific  sections  of  the  report  by  individual 
contributors  is  acknowledged  in  this  volume  and  in  Volume  III.  Unless 
otherwise  noted,  all  contributors  are  JPL  personnel. 
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SECTION  2 


INTRODUCTION 


1.1  PURPOSE,  FORMAT  ANO  USE  OF  THIS  VOLUME 


1.1.1  Purpose 

The  purpose  of  this  volume  is  to  describe  the  existing  DSCS  III 
satellite  system  in  a  functional  manner,  and  to  assess  its  current  level  of 
autonomy.  This  volume  addresses  only  the  current  (Block  A)  desiqn  for  the 
first  OSCS  III,  and  does  not  address  any  programmed  changes  in  future  Blocks 
of  OSCS  III. 


1.1.2  Format  and  Use 

The  format  of  this  volume  is  designed  to  describe  each  function 
in  terms  of  the  "sensing",  "direction"  and  "action"  functions  as  explained  in 
Section  6.1.2  of  Volume  I.  While  this  format  creates  a  lack  of  "flow"  in  the 
text,  it  has  been  selected  for  easy  cross-reference  with  Volume  III,  which 
describes  options  for  making  the  DSCS  III  more  autonomous.  Volume  I  should  be 
read  as  background  for  Volumes  II  and  III. 

The  formats  of  Volumes  II  and  III  are  identical,  in  that 
paragraphs  devoted  to  each  function  have  the  same  numbers  in  Volumes  II  and 
III.  Therefore,  the  user  can  cross-reference  between  the  current  way  the 
function  is  performed  (Volume  II),  and  the  options  for  performing  the  function 
more  autonomously  (Volume  III)  by  referring  to  the  same  paragraph  numbers. 


1.2  ASSESSMENT  FUNCTIONAL  CLASSIFICATION 

The  DSCS  III  functions  were  classified  in  three  ways:  by  level 
of  autonomy,  by  importance,  and  by  difficulty  of  implementation.  Two  of  these 
classifications  (level  and  importance)  are  used  in  this  volume,  and  are 
described  in  the  following  paragraphs. 


1.2.1  Levels  of  Autonomy 

The  levels  specified  in  the  Goals  Document  (Reference  1)  were 
applied  to  both  the  existing  DSCS  III  and  the  autonomy  options.  These  levels 
(from  D  to  10)  are  reproduced  in  Appendix  A. 


1.2.2  Importance 

The  primary  requirement  which  drives  the  DSCS  III  autonomy  is 
for  the  spacecraft  to  operate  with  reduced  ground  intervention.  As  stated  in 
the  Goals  Document: 
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The  autonomous  spacecraft  shall  he  capable  of  successfully 

perform' nq  the  mission  function  for  an  extended  period  of  time 

without  ground  support  at  a  specified  level  of  conflict. 

Speci f ical ly : 

(1)  Autonomous  spacecraft  shall  operate  without  performance 
degradation  for  up  to  60  days  from  the  last  initialization 
update. 

(2)  Autonomous  spacecraft  shall  operate  for  up  to  6  months  from 
the  last  initialization  update.  They  shall  do  so  within 
acceptable  performance  degradation  limits  for  mission- 
prioritized  functions  as  defined  by  each  mission. 

These  requirements  were  used  as  the  basis  for  prioritization  of 
autonomous  operation  as  follows: 

(1)  Category  I:  Functions  which  must  be  performed  autonomously 
for  the  spacecraft  to  meet  the  60-day/6-month  requirement. 

(2)  Category  II:  Functions  which  must  be  performed 
autonomously  for  lifetime  protection  (battery  conditioning, 
etc.)  or  which,  if  performed  autonomously,  would  increase 
the  operability  or  operational  flexibility  of  the 
spacecraft. 

(3)  Category  III:  Functions  not  requiring  autonomy. 


in 


1.3 


OVERVIEW  DESCRIPTION  OF  EXISTING  DSCS-III  DESIGN* 

An  overview  is  given  in  this  section  to  describe  the  DSCS  III 
configuration  which  was  assessed  in  this  study.  Mission  and  system 
requirements  on  the  existing  DSCS  III  are  called  out  in  Sections  1.4  and  1.5. 
These  requirements  will  also  apply  to  the  Autonomous  DSCS  III  satellite. 
Requirements  on  each  function  which  are  applicable  to  the  existing  DSCS  III 
are  noted  in  each  Section  at  the  beginning  of  the  function's  description. 


1.3.1  Mission 

The  mission  of  the  DSCS  III  satellite  is  to  provide  enhanced 
military  communication  capability  during  the  1 98D ' s  and  1 9^0 ' s  period. 

Several  DSCS  III  satellites,  each  with  a  10  year  mission  life,  operating  in 
geostationary  orbit,  provide  long  term,  worldwide,  protected  services  to 
ground,  ship  and  airborne  forces.  Users  of  the  system  range  from  airborne 
terminals  with  33  in.  diameter  antennas  to  fixed  installations  with  6fl  foot 
diameter  antennas.  Mobile  terminals  supporting  ground  and  naval  operations 
communicate  with  each  other  and  the  command  chain  through  the  satellite. 
Communication  resources  are  provided  through  six  independent  satellite 
channels  for  user  grouping  according  to  their  operational  needs  or  geographic 
situation;  and  also  receiver  sensitivity  or  transmitter  power  is  allocated 
among  them  for  maximum  efficiency.  The  DSCS  III  satellite  also  provides  an 
on-board  Single  Channel  Transponder  to  supplement  currently  dedicated  AFSATCOM 
spacecraft  for  Command  and  Control  Communication  from  the  National  Command 
Authorities  and  Commanders  to  the  nuclear  and  support  forces. 


1.3.2  Communications  Subsystem 

The  primary  purpose  of  the  Communications  Payload  of  the  DSCS 
III  satellite  is  to  provide  a  flexible,  wide-hand  transmission  medium  so  that 
satellite  unique  services  are  provided  to  approved  users  under  varying  degrees 
of  system  stress.  The  user  terminals  are  distributed  throughout  the  world  and 
are  of  varying  sizes.  The  operational  concept  is  to  maximize  communication 
throughout  by  distributing  the  satellite  Effective  Isotropic  Radiated  Power 
(EIRP)  optimally  according  to  terminal  location,  size  and  capacity 
requirements.  The  EIRP  distribution  is  implemented  by  reconfiguring  the 
transmit  Multi-Ream  Antennas  (MBA's)  to  provide  earth  coverage  or  selective 
coverage  and/or  utilizing  the  Earth  Coverage  Horn  (ECH)  antenna,  Gimbaled 
Dish  Antenna  (GDA)  or  MBA  for  transponder  channels  1,  2,  3,  and  4.  Uplink 
antenna  gain  and  jammer  discrimination  is  implemented  by  using  ECH  or  MRA  and 
configuring  the  MBA  for  earth  coverage,  selected  coverage  or  jammer  nulling. 
Each  transponder  channel  gain  may  also  be  set  by  ground  command. 
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1.3.3 


Single  Channel  Transponder 


The  AFSATCOM  Single  Channel  Transponder  (SCT)  is  a  dual 
frequency  band,  frequency  conversion,  digital  demodulation/remodulation, 
communications  transponder  with  integral  command  reception/execution 
capability.  The  primary  function  of  the  SCT  is  secure  and  reliable 
di ssemination  of  the  Emergency  Action  Message  (EAM)  and  Single  Integrated 
Operational  Plan  (SIOP)  Communications  from  Worldwide  Command  Post  ground 
stations  and  aircraft  to  the  force  elements. 

1.3.4  Operations 

The  primary  operational  monitoring  and  control  of  the 
Communications  Payload  is  via  Superhiqh  Frequency  (SHF)-band  from  an 
Engineering  Development  Model  of  the  Satellite  Configuration  Control  Element 
(EDM-SCCE)  and  the  collocated  SHF  Ground  Terminal;  the  primary  operational 
monitoring  and  control  of  satellite  support  subsystems  is  via  S-Band  from  the 
Air  Force  Satellite  Control  Facility  (AFSCF). 

Various  secondary  operational  modes  of  control  are  possible  in 
the  event  of  temporary  unavailability  of  the  Satellite  Control  Facility 
-Remote  Tracking  Station  (SCF-RTS)  Network,  temporary  outages  at  the 
EDM-SCCE' s  and/or  the  SHF  Ground  Terminals,  or  permanent  Telemetry,  Tracking 
and  Command  Subsystem  (TT&C)  failures. 

Backup  command  and  control  capability  for  the  Communication 
Payload  will  be  provided  by  the  SCF  based  on  command  sequences  generated  by 
the  Communications  Configuration  Program  (CCP)  and  transferred  to  the  SCF  via 
secure  teletype  links  from  the  EDM-SCCE  in  the  event  of  SHF  Ground  Terminal 
temporary  outages  for  transmission  to  the  satellite  by  S-band.  The  backup 
S-band  capability  will  also  be  used  in  the  event  of  permanent  failure  to  the 
SHF  TT&C.  Operational  discipline  will  be  maintained  to  avoid  conflicting 
commands. 


Backup  command  and  control  capability  of  the  satellite  support 
subsystems  will  be  provided  by  the  EDM-SCCE  and  the  associated,  collocated  SHF 
Ground  Terminals  based  on  command  or  command  sequences  generated  by  the  SCT 
and  transferred  by  secure  telephone  links  to  the  EDM-SCCE.  This  backup 
capability  will  be  used  primarily  to  react  to  support  subsystem  anomalies 
detected  at  the  EDM-SCCE  for  fast  reaction  correction  capability  or  in  the 
event  of  permanent  failures  to  the  satellite  S-band  TT&C  system. 

Figures  1-1  and  1-2  show  the  major  elements  involved  in  DSCS  III 
Communications  Subsystems  operation.  Their  functions  are  as  follows: 

(1)  The  Defense  Communication  Agency  Operations  Center  (DCAOC) 
provides  the  traffic  coordination  between  the  users  and  the 
Defense  Communications  Engineering  Center  (Df.EC). 

(2)  The  DCEC  provides  the  resource  allocation  function  between 
the  DCAOC  and  the  EDM-SCCE  to  convert  the  user  traffic 
requirements  into  a  valid  set  of  DSCS  III  satellite 
Communication  Payload  conf iguration  requi rements. 
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Figure  1-2.  System  Integration  Operations 


(3)  The  EDM-SCCE  provides  the  processing  function  between  the 
DCEC  and  the  DCSC  III  Ground  terminals  to  convert  satellite 
communication  payload  configuration  requirements  into 
command  sequences. 

(4)  The  OSCS  Earth  Terminal  provides  continuous  SHF  telemetry 
and  command  links  between  the  EDM-SCCE  and  the  DSCS  III 
Satel lite. 

(5)  The  satellite,  when  deployed  in  synchronous  equatorial 
orbit  provides  relaying  of  communications  between  users 
through  the  Communication  Payload  which  consists  of  a 
combination  of  Multibeam  Antennas  and  Earth  Coverage 
Antennas  interconnected  to  six  SHF  variable  gain 
transponders. 

(6)  The  Satellite  Control  Facility  (SCF)  consisting  of  the 
Satellite  Test  Center  (STC)  and  various  Remote  Tracking 
Stations  (RTS's)  provides  the  command  and  control  of  the 
DSCS  subsystems  and  performs  orbit  determination. 

Three  major  software  elements  are  defined  for  command  and  con¬ 
trol  of  the  satellite,  the  CCP,  the  Telemetry  and  Command  Program  (TCP),  and 
the  DSCS  III  Control  Programs  (DCP)  which  are  resident  at  locations  shown  in 
Figure  1-2.  In  addition.  Communications  Simulator  Software  is  available  for 
planning  and  evaluation  of  Communication  configuration  and  performance  in 
meeting  user  requirements. 


1.4  DSCS  III  MISSION  REQUIREMENTS 

A  fully  autonomous  DSCS  III  satellite  must  meet  the  same 
requirements  as  the  current  DSCS  III  satellite,  but  must  do  so,  allowing  for 
acceptable  degradation,  without  ground  intervention  for  up  to  6  months. 

Current  DSCS  III  requirements  are  included  here  for  the  purpose  of  defining 
requirements  on  the  autonomous  DSCS  III.  The  DSCS  III  satellite  will 
continuously  provide  secure  communications  capability  between  any  two  points 
in  a  designated  service  area. 

The  service  area  contains  all  points  within  line  of  sight  of  the 
satellite  and  where  the  elevation  angle  to  the  satellite  is  7.5  degrees  or 
greater.  The  center  of  a  service  area  is  nominally  a  specified  fixed  point  on 
the  earth's  equator. 

The  communication  capability  will  be  maintained  in  a  defined 
nuclear  environment  and  in  an  electronic  jamming  environment. 

The  expected  satellite  operational  life  will  be  ten  years. 
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The  satellite  will  relay  signals  in  the  SHF  region.  The  signals 
will  contain  telephone,  data,  wide-band  imagery,  and  secure  digital  voice 
signals.  The  signals  to  be  relayed  will  use  Frequency  Modulation  (FM); 
Bi-Phase  Shift  Keying  (BPSK) ;  Quadra-Phase  Shift  Keying  (OPSK);  Staggered 
Ouadra-Phase  Shift  Keying  (SOPSK);  and  frequency-hopping,  Pseudo-Random  Noise 
(PRN),  spread-spectrum  modulation.  Access  techniques  will  include  Time 
Division  Multiple  Access  (TDMA),  Frequency  Division  Multiple  Access  (FDMA), 
Code  Division  Multiple  Access  (CDMA)  and  Spread  Spectrum  Multiple  Access 
( SSMA) . 


1.5  PSCS  III  SYSTEM  REQUIREMENTS 

This  section  provides  an  overview  of  requirements  on  the 
existinq  PSCS  III  System.  More  detailed  requirements  which  are  placed  hy  the 
payload  on  the  spacecraft  are  outlined  in  Appendix  B. 

1.5.1  Communications  Payload 

To  meet  the  sensivity  requirements  of  all  users,  the  spacecraft 
communications  payload  will  provide  steerable,  adjustable-width  antenna  beams 
that  produce  the  minimum  EIRP's  over  the  defined  beam  widths,  as  shown  in 
Table  1-1. 


Table  1-1.  Downlink  EIRP  Requirements 


Channel 

TWTA 

Output 

Power 

(dBw) 

Effective  Isotropic  Radiated  Power  (dBw) 

MBA 

Narrow1 2 

Coverage 

MBA 

Earth3 4 

Coverage 

Earth 
Coverage 
Horn  (4) 

Gimbal led 

Dish 

Antenna  (2) 

1 

16 

40 

29 

Not  used 

44.0 

2 

16 

40 

29 

Not  used 

44.0 

3 

10 

34 

23 

25 

Not  used 

4 

10 

34 

23 

25 

37.5 

5 

10 

Not  used 

Not  used 

25 

Not  used 

6 

10 

Not  used 

Not  used 

25 

Not  used 

(1)  Narrow  coverage  refers  to  providing  the  EIRP  over  a  narrow  coverage 
beam  width  of  +0.71°. 

(2)  The  GDA  will  provide  the  EIRP  over  a  beam  width  of  +1.8°. 

(3)  Earth  coverage  for  the  MBA  refers  to  providing  the  TlRP  over  a  beam  width 
of  +8.75°. 

(4)  Earth  coverage  for  the  Earth  Coverage  Horn  refers  to  providing  the  EIRP 
over  a  beam  width  of  +8.8°. 
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To  meet  the  satellite  receiver  sensitivity  requirements 
necessary  to  interface  with  any  ground  transmitter,  the 
ratios  of  receive  antenna  gain  to  system  noise  temperature  (G/T)  will  be  as 
shown  in  Table  1-2. 


Table  1-2.  G/T  Requirements 


CHANNEL 

— 

1,  2,  3,  4 

5,  6 

MBA 

HORN 

HORN 

ANTENNA 

NC 

EC 

EC 

EC 

G/T  (dB/K) 

-1  to  10.1 

-15.1 

-13.0 

-12.8 

NOTE:  EC  =  Earth  Coverage 
NC  =  Narrow  Coverage 


Performance  defined  for  the 
same  beam  widths  as  for  EIRP. 


The  given  values  of  EIRP  and  G/T  include  any  and  all 
contributors;  specifically  pointing,  attitude  control,  and  stationkeeping. 


1.5.2  Orbit 

The  DSCS  III  satellite  will  operate  from  designated  locations  in 
geostationary  orbit  while  maintaining  station  and  attitude. 


1  .5.3  Launch 

The  first  satellite  will  be  launched  from  the  Eastern  Test  Range 
(ETR)  on  a  Titan  IIIC  as  a  dual  launch  with  a  DSCS  II  satellite.  The  launch 
time  will  be  chosen  such  that  the  initial  inclination  decays  toward  zero 
degrees. 

Dry  weight  at  launch  _<860  kg 
Wet  weight  at  launch  <1137  kg. 
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1.5.4  Propulsion 

Sufficient  propulsion  capability  should  be  provided  for: 

(1)  correction  of  launch  vehicle  injection  errors. 

(2)  attitude  control  for  the  planned  mission  duration  of  1 0 
years. 

(3)  adjusting  inclination  from  2.5  degrees  to  0.5  degrees 
before  reaching  initial  orbital  station  longitude. 

(4)  achieving  the  initial  orbital  test  station  of  105°W  or 
115°W  within  40  days  of  injection. 

(5)  repositioning  from  the  initial  orbital  test  station  to 
initial  operational  station  at  any  longitude. 

(6)  maintaining  the  satellite  at  achieved  station  to  +0.1 
degree  in  longitude. 

(7)  maintaining  the  inclination  within  0.1  degree. 

The  budget  will  be  at  least  600  ft/sec  maneuvering  capability 
either  for  N-S  stationkeeping  or  relocation  to  be  used  at  the  discretion  of 
the  operators. 


1.5.5  S/C  Control  and  Monitoring 

The  satellite  shall  be  capable  of  being  commanded  both  at  SHF 
and  S-Band  to  allow  housekeeping,  orbit  maintenance  and  Communication  Payload 
subsystem  reconfiguration  by  the  SCF  and  0SCS  ground  stations. 

The  satellite  shall  be  capable  of  sending  telemetry  at  both  SHF 
and  S-Band  to  allow  routine  housekeeping  monitoring,  to  verify  command 
reception  and  execution,  and  to  monitor  operations. 

The  telemetry,  tracking,  and  command  operations  shall  be  capable 
of  being  conducted  simultaneously  with  the  payload  communication  operations, 
without  degradation  or  interference  with  either  operation. 


1.5.6  Navigation 

Ephemeris  information  will  be  furnished  to  sufficient  accuracy 
to  meet  user  needs  for  pointing,  range,  and  range  rate  information. 

Information  will  also  be  furnished  to  sufficient  accuracy  for  appropriate 
stationkeeping  maneuvers.  Stationkeeping  must  be  sufficiently  accurate  to  not 
cause  the  EIRP  and  G/T  limitations  to  be  violated. 
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1.5.7  Power 

The  satellite  shall  provide  power  throughout  the  mission, 
including  eclipse  periods.  With  total  battery  charge  depletion  the  satellite 
shall  continue  to  provide  full  communications  during  sunliqht,  following  the 
post-eclipse  recovery  period. 


1.5.8  Attitude  Control 

Attitude  control  shall  be  autonomous  with  a  ground  override 
command  capabil ity. 

Attitude  control  accuracy  will  be  sufficient  not  to  cause  the 
payload  EIRP  and  G/T  limitations  to  be  violated. 


1.5.9  Reliability 

The  satellite  shall  have  a  desiqn  life  in  orbit  of  at  least  10 
years,  by  maintaining  performance  despite  all  identifiable  wearout  factors  and 
depletion  of  expandables. 

A  requirement  for  survival  shall  be:  (a)  at  least  50%  of  the 
communications  channels  shall  he  operative,  with  at  least  one  being  a  40W 
channel  which  must  be  able  to  transmit  through  an  MBA  as  well  as  receive 
through  an  MBA.  Sufficient  Earth-coverage  transmit/receive  horns  shall  be 
operative  to  provide  the  specified  minimum  channels;  (b)  either  the  S-Rand  or 
SHF  command  capability  shall  be  operative;  (c)  minimum  essential  telemetry 
with  continuous  power  to  maintain  communications  service  shall  be  operative; 
(d)  attitude  and  pointing  control  shall  be  sufficient  to  support  (a),  (b),  and 
(c). 

Single  point  failures  are  to  be  avoided  in  the  design.  Recovery 
from  a  failure  shall  not  be  contingent  upon  continuous  monitoring  of  the 
satellite  telemetry  system. 


1.5.10  Timing 

The  space  segment  will  furnish  a  network  timing  signal  to  the 
appropriate  users.  Timing  standard  accuracy  will  be  maintained  to  a  degree 
sufficient  to  satisfy  the  needs  of  all  users  at  all  times. 


1.5.11  Ground  Antenna  Pointinq 

The  satellite  will  furnish  a  radio  frequency  (RF)  beacon  signal 
that  certain  users  can  utilize  to  automatically  keep  their  antennas  pointing 
at  the  satellite. 
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1.5.12 


Thermal  Control 


The  satellite  shall  be  thermally  controlled  so  that  all 
components  are  maintained  at  or  above  their  minimum  operating  temperature 
under  normal  conditions.  Under  abnormal  conditions,  when  possible,  the 
satellite  components  shall  be  maintained  at  or  above  their  survival 
temperatures. 


1.6 


AUTONOMY  ASSESSMENT  SUMMARY  OF  THE  EXISTING  DSCS  III  SATELLITE 


The  existinq  PSCS  III  has  the  following  characteristics  relevant 
to  autonomy  (Refer  to  Appendix  A  for  level  definitions): 


(1)  It  is  a  complex  spacecraft  which  requires  frequent  ground 
interaction  to  meet  the  mission  requirements, 

(2)  The  routine,  on-station  service  functions  (power,  attitude 
control,  thermal  control,  etc)  are  already  quite  autonomous 
(up  to  level  5)  except  for  stationkeepinq ,  which  is  a  level 
zero. 

(3)  The  resource  management  and  integrity  maintenance  functions 
almost  all  require  ground  intervention.  They  range  from 
level  0  to  level  5,  but  are  predominantly  at  level  2. 

(4)  It  appears  that  an  overall  spacecraft  autonomy  level  of  5 
is  required  to  meet  the  60  day/6  month  undirected 
performance  requirement. 

Figure  1-3  summarizes  the  autonomy  levels  of  the  existing  DSCS 
III  functions.  As  before,  the  functions  are  classified  as  Services, 

Resources,  and  Integrity,  and  by  Category  (I,  II,  III),  The  length  of  each 
bar  in  the  figure  represents  the  number  of  functions  at  that  level  of 
autonomy.  (Refer  to  Appendix  A  for  autonomy  level  definitions.)  Category  I, 
II,  and  III  functions  are  designated  separately. 

Figure  1-3  illustrates  that  the  Services  functions  tend  to 
cluster  around  Level  3,  the  Resources  functions  around  Level  1  or  2,  and  the 
integrity  functions  around  Level  2.  Services  functions,  except  for 
stationkeepinq,  are  at  higher  levels  because: 

(1)  The  power  and  thermal  control  functions  have  a  good  deal  of 
hard-wired,  autonomous  functions,  and 

(2)  The  attitude  control  function  has  considerable  autonomy 
implemented  in  both  software  and  hardware,  whereas 

(3)  Resources  and  Integrity  functions  are  almost  entirely 
ground  directed,  and 

(4)  Stationkeeping  is  entirely  ground  directed. 

Figure  1-3  also  illustrates  that  the  majority  of  functions  are 
Category  I,  that  is,  they  must  be  autonomous  for  the  spacecraft  to  operate  for 
6  months  without  ground  intervention.  In  order  to  meet  the  requi rements,  the 
majority  of  Category  I  functions  will  need  to  be  raised  to  about  Level  5. 
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Table  1-3  lists  the  functions  which  were  used  to  make  up  Figure 
1-3,  by  autonomy  level  and  category.  The  paragraph  numbers  in  Table  1-3  refer 
to  both  Volumes  II  and  III.  Later  sections  in  Volume  II  contain  a  detailed 
description  of  these  functions.  Volume  III  gives  details  on  options  for 
increasing  the  autonomy  of  each  function. 


0**NT  SOU*  A* (LAY  (ACS) 
MAINTAIN  SA  OCICNTATION  (ACS) 


(continued) 


Table  1-3  (continued) 


4. 2. 2. 4  RIG  E  LECT  RON  ICS/QUAD  RELAY  FAU.URE  (EROS) 

4. 3. 2. 3  NUCLEAR  EVENT  (ACS) 

4.3. 2.4  PROTECT  EARTH  SENSOR  (ACS) 


SECTION  2 


PAYLOAP  SERVICES 


This  Section  describes  the  current  functions  of  the  spacecraft 
which  make  it  possible  for  the  payload  to  carry  out  the  mission  of  PSCS  III. 
These  functions  are: 


(1) 

Provide 

power 

(2) 

Provide 

attitude  control 

(3) 

Provide 

thermal  control 

(4) 

Provide 

spacecraft  control  and  monitoring 

(5) 

Provide 

timi ng 

(6) 

Provide 

direct  payload  services 

(7) 

Provide 

stationkeeping 

Figure  2-1  displays  these  functions  in  a  hierarchical  form. 
Each  of  these  functions  has  its  own,  lower-level  hierarchy  displayed  in  the 
section  which  address  that  function.  The  numbers  in  boxes  correspond  to 
paragraph  numbers. 
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Figure  2-1.  DSCS  III  Services  Functional  Hierarchy 


2.1  PROVIDE  POWER* 

The  power  provision  function  comprises  solar  power  collection, 
power  conditioning,  energy  storaqe  and  power  distribution.  Power  is  collected 
by  solar  panels.  Three  batteries  provide  storage  for  eclipses  and  other  cases 
where  consumption  exceeds  the  direct  capacity  of  the  solar  panels.  Althouqh 
the  solar  array  articulation  is  controlled  by  the  attitude  control  subsystem, 
its  functional  description  is  included  in  this  section.  The  power  provision 
function  contains  a  number  of  autonomous  features  implemented  in  hardware. 
Figure  2-2  shows  the  power  provision  functions  in  a  hierarchy. 


2.1.1  Collect  Solar  Power  -  Level  4/Cat.egory  I 


2 . 1 . 1 . 1  (Post  Separation)  Orient  Solar  Array. 

2. 1.1. 1.1  Control  Solar  Array  (SA)  Articulation.  The  post-launch 
initiation  timer  triggers  SA  articulation.  Normal  drive  signals  are  triggered 
by  the  ACE  clock.  Snecial  slew  commands  are  sent  from  the  ground.  The  solar 
array  drive  (SAD)  is  controlled  by  the  ACS,  which  provides  articulation  pulses 
for  the  SAD  stepper  motor  driver  signals. 


2. 1.1. 1.2  Select  SA  Drive  Mode.  Post  launch,  the  SA  drive  mode  is 
preselected  by  the  ground  and  autonomously  implemented  by  the  ACS.  The  ACS 
controls  SAD  polarity  by  providing  normal  SAD  drive  signals  or  variable 
forward  slew  rates  by  ground  command. 


2. 1.1. 1.3  Select  SA  Drive  Pot.  The  solar  array  drive  pot  is  preselected 
by  the  ground. 


2. 1.1. 2  Maintain  Solar  Array  (SA)  Orientation  Accuracy  of  *1°  to 

Sun  Line. 


2. 1.1. 2.1  SA  Position  Control .  The  ACS  sun  sensors  (Pitch  sensors) 

provide  the  sun  line  anqle  relative  to  the  SA.  The  ACS  computes  the  error  and 
directs  the  SAD.  The  SAD  nulls  the  sun  line  error. 


*By  R.  C.  Detwiler,  E.  P.  Kan,  T.  W.  Koerner,  E.  Mettler  and  G.  W.  Wester. 


PROVIDE  POWER 


Figure  2-2.  Power  Service  Functional  Hierarchy 


2. 1.1. 2. 2  SA  Misalignment  Bias  Correction;  Initial  Prelaunch  Ground 

Calibration.  ACS  sun  sensor  data  is  issued  by  the  ground  to 
perform  the  calibration.  The  ACS  uses  the  calibration  bias  values  for 
corrected  sun  sensor  angle  and  SAD  command  generation.  The  SAD  drives  the 
Solar  Array  to  the  corrected  orientation. 


2. 1.1. 3  Correct  Solar  Array  Misalignment.  The  ground  periodically 

calibrates  the  solar  arrays  for  misalignment.  A  misalignment  bias  correction 
signal  is  provided  to  the  ACS  which  adds  it  to  the  roll  differential  signal 
for  driving  the  solar  array  to  the  correct  orientation. 


2.1.2  Condition  Power 


2. 1.2.1  Regulate  Main  Bus  Voltage  (28  VDC  ±1%)  -  Level  5/Category  I. 


2. 1.2. 1.1  Sense  Bus  Voltage.  The  bus  voltage  is  sensed  and  the  error 
signal  is  generated  in  the  Power  Regulation  Unit  (PRU). 


2. 1.2. 1.2  Direct  Voltage  Regulation.  Using  the  error  signal,  the  PRU 
directs  and  controls  the  toost  converter,  battery  charge  regulator  (BCR),  and 
shunt  dissipator  (SD)  in  an  automatic  analog  feedback  loop. 


2. 1.2. 1.3  Drive  Boost  Converter.  The  PRU  drives  the  boost  converter, 
battery  charge- regul ator  and  shunt  dissipator. 


2. 1.2. 2  Provide  Isolated  Auxiliary  Voltages  -  Level  5/Category  I.  DC  to 

DC  converters  autonomously  convert  the  28  VDC  Main  Bus  Voltage  to  auxiliary 
voltages  for  various  loads  (+28  Vdc,  +24  Vdc,  +15  Vdc,  Vdc,  +19  Vdc, 

+8  Vdc,  +5  Vdc) 


2. 1.2. 3  Fire  Electro-Explosive  Devices  -  Level  5/Category  I.  The  firing 

of  electro-explosive  devices  (EED)  is  a  parallel,  block  redundant,  automatic 
function.  EED  functions  are  presently  a  part  of  the  launch  sequence. 


2.1.3  Distribute  Power  -  Level  2/Category  I 


2. 1.3.1  Sense  Distribution  Relay  Status.  Status  signals  (open/closed) 

of  selected  relays  are  sensed  and  provided  to  telemetry. 


2. 1.3. 2  Direct/Control  Power  Distribution.  The  ground  segment  directs 

power  distribution  by  controlling  relays. 


2. 1.3. 3  Open/Close  Relays.  Commands  to  open/close  power  distribution 

relays  are  executed. 
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2.2 


PROVIDE  ATTITUDE  CONTROL 


The  attitude  control  service  function  initially  stabilizes  the 
spacecraft  after  separation  from  the  launch  vehicle,  and  then  maintains 
stability,  both  during  normal  on-orbit  operations  and  during  maneuvers.  The 
attitude  control  function  also  reacquires  references,  if  lost,  when  commanded 
to  do  so  by  the  ground.  The  attitude  control  service  function  includes 
computational  capability  and  a  number  of  autonomous  features  implemented  in 
both  hardware  and  software. 

The  attitude  control  function  utilizes  sun  sensors,  earth 
sensors,  rate  gyros,  reaction  wheels,  thrusters,  and  a  computer  to  stabilize 
and  maintain  the  spacecraft  attitude.  The  attitude  control  subsystem  (ACS) 
implements  the  attitude  control  functions.  The  ACS  also  performs  a  number  of 
other  functions,  such  as  solar  array  articulation,  post  separation  timing  and 
direct  commanding  of  some  payload  antenna  functions.  These  auxiliary  ACS 
functions  are  described  in  their  appropriate  functional  areas. 

Because  of  its  computer  the  attitude  control  function  contains  a 
number  of  autonomous  capabi 1 i ties.  These  include: 

Post  Launch  3-Axis  Stabilization 


Automatic  Sun  Acquisition  -  Sensed  sun  line  and  satellite 
orientation  control  for  (-Z)  to  sun 

Automatic  Earth  Acquisition  -  Earth  limb  detection  and  control 
(+Z)  NADIR,  upon  ground  enable  command. 

Nominal  On-Orbit  Autonomy 

Attitude  States  -  Estimated  and  sensed  attitude  within  limits 
for  pitch,  rol 1 ,  yaw. 

Momentum  states  -  Reaction  wheel  speed  is  tachometer  sensed. 

Momentum  Distribution  -  Comparison  of  actuals  to  predicted 
values  for  disturbance  torque  is  reconciliation  method. 

Yaw  Noon/Midnight  Control  -  Actual  yaw  drift  within  predicted 
1 i mi ts. 

Sun  Bias  Update  -  Noon/midnight  yaw  drift  used  to  compute  roll 
torques/  updates. 

Wheel  Unloading  -  Momentum  thresholds  and  actual  wheel  speeds 
compared/thruster  fired  to  satisfy  required  distribution. 
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devices: 


The  attitude  control  function  utilizes  a  computer  and  peripheral 


Computer: 

Central  Processor  Units  (CPU) 

Random  Access  Memories  (RAM) 

Read  Only  Memories  (ROM) 

Hardened  Random  Access  Memories  (HRAM) 

Input/Output  Ports 

Peripheral  Devices: 

Reaction  Wheels 

Thrusters 

Solar  Array  Drive 

Payload  Beam  Forming  Network  (BFN) 

Gimbaled  Dish  Antenna  (GDA) 

Earth  Sensor  and  Sun  Sensors 
Rate  Gyro 

Command  and  Telemetry 
Radiation  Detector 

A  more  complete  description  of  the  computer  and  the  peripherals 
is  contained  in  Appendix  C. 

Figure  2-3  shows  the  hierarchy  of  the  Provide  Attitude  Control 

Function. 

2.2.1  Stabilize  Attitude  (From  any  attitude,  for  Rates  <l°/sec/axi s) 


2. 2. 1.1  (Post  launch)  Acquire  Sun  and  Reduce  Tip-off  Rates  -  Level 
4/Category  I. 

2. 2. 1.1.1  Sense  Attitude  and  Rates.  Post  separation  tip-off  is  required 
to  be  less  than  1 .l°/sec/axi s.  When  the  sun  is  in  the  sun  sensor  field  of 
view  (which  is  almost  180°),  the  sensor  provides  pitch/roll  information  to  the 
ACS  control  loop.  The  rate  gyro  provides  yaw  rate  information  to  the  ACS 
control  loop.  The  rate  gyro  is  used  during  post  launch  initialization, 
reference  reacquisition,  and  may  be  used  for  yaw  control  at  other  times  if 
ground  commanded.  The  ACS  control  loop  determines  pitch/roll  positions  from 
the  sun  sensor  signal  and  yaw  rate  from  rate  gyro  signal . 


2. 2. 1.1. 2  Direct/Control  Sun  Acquisition/Tip-Off  Rate  Reduction.  The  ACS 

selects  control  loop  parameters  by  putting  the  outer  control  loops  (pitch, 
roll,  and  yaw)  in  the  fast  (2-second)  update  mode  and  the  wide  dead  band  mode 
(wide  dead  band  =  +7.68°  pitch  position,  +3.84°  roll  position,  0.32°/sec  yaw 
rate).  The  ACS  directs  the  thrusters  to  Tow  torque  mode  (16  ms  pulse  width) 
and  directs  catalyst  bed  heater  warmup.  The  ground  preselects  thruster  pairs 
and  latch-valve/tank  configuration  for  resource  management  and  integrity 
maintenance.  The  outer  loop  control  directs  thruster  firings  to  reduce  errors 
within  these  wide  dead  band  limits. 
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Figure  2-3.  Attitude  Control  Service  Functional  Hierarchy 


2. 2. 1.1. 3  Acquire  Sun/Reduce  Rates.  Pitch  roll,  yaw  thrusters  of  the 
selected  bank  are  fired  to  provide  turn  impulse  until  the  sun  is  acquired  and 
pitch,  roll,  yaw  position  and  rate  errors  are  within  the  wide  dead  band 
limits.  In  order  to  maintain  attitude  the  thrusters  provide  limit  cycle 
pulsinq.  The  S/C  attitude/rate  is  maintained  within  wide  dead  band  limits 
until  earth  acquisition  is  initiated.  (This  is  called  the  sun-hold  mode.) 

2. 2. 1.2  (Post  Launch)  Acquire  Earth  -  Level  3/Category  I. 


2. 2. 1.2.1  Sense  Attitude  and  Rates.  The  sun  sensor  senses  pitch  and  roll 
angles  and  the  sun  line  direction.  TFe  solar  array  drive  pot  senses  the  solar 
array  anqle  relative  to  S/C.  The  rate  gyro  provides  yaw  rate  information  to 
ACS  control  loop. 

When  the  earth  is  in  the  field  of  view  of  the  earth  sensor,  an 
earth  presence  siqnal  is  transmitted  to  the  ground.  If  the  S/C  is  coninq  at 
an  anqle  greater  than  8.5°  declination  the  earth  may  not  enter  the  field  of 
view  of  the  sensor  until  thrusters  are  fired  (by  ground  command)  to  reduce  the 
coning  anqle.  When  the  earth  sensor  views  the  earth  it  provides  pitch  and 
roll  data. 


2. 2. 1.2. 2  f)i rect/Control  Earth  Acquisition.  When  sun  acquisition  is 

complete,  as  indicated  by  pitch,  roll,  yaw  position  and  rate  telemetry  the 
ground  monitors  the  earth  presence  signal  at  local  noon,  or  midnight.  When 
the  earth  presence  signal  occurs  at  the  proper  intervals  (due  to  S/C  coning), 
the  ground  sends  earth  acquisition  mode  enable  signal  and  also  sends  the  sun 
declination  bias  angle  which  is  used  in  the  on-board  sun  orientation 
algorithms.  If  no  sun  bias  were  included  the  S/C  would  point  directly  at  the 
sun  rather  than  maintaining  earth  reference. 

The  ACS  puts  outer  control  loops  in  the  fast  (2  sec)  update  mode 
and  selects  the  medium  deadband  +1.92°  pitch,  +1.92°  roll,  0.24°/sec  rate  in 
yaw.  The  ACS  directs  the  thrusters  to  the  high  torque  mode  (1  sec  pulse 
width)  and  directs  catalyst  bed  heater  warm-up.  The  ground  preselects  latch 
valve/tank  configuration  and  thruster  pairs. 


2. 2. 1.2. 3  Acquire  Earth.  Pitch,  roll,  yaw  thrusters  of  the  selected  bank 

are  fixed  to  provide  turn  impulse  until  the  earth  is  acquired  and  pitch,  roll, 
yaw  position  and  rate  errors  are  within  medium  dead  band  limits.  The 
thrusters  provide  limit  cycle  pulsing  to  maintain  attitude  until  reaction 
wheels  are  activated.  The  S/C  attitude/rate  is  maintained  within  medium  dead 
hand  limits. 


2. 2. 1.3  Configure  S/C  for  Normal  Operations  -  Level  3/Cateqory  I. 


2. 2. 1.3.1  Sense  S/C  Orientation.  The  pitch  sun  sensor  gives  sun  line 
information;  the  solar  array  drive  pot  gives  solar  array  spacecraft  angle 
i nformation. 
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2. 2. 1.3. 2  Pi rect/Control  S/C  Configuration.  The  ACS  directs  solar  array 
slewing  to  sun  line  normal .  The  ACS  selects  narrow  dead  band  outer  control 
loop  parameters  and  low  torque  thruster  pulse  width  (16  ms).  The  qround 
directs  reaction  wheel  turn-on.  The  ground  enables  ACS  autonomous  modes  for 
routine  on-orbit  attitude  stabilization. 


2. 2. 1.3. 3  Configure  S/C.  The  solar  array  slews,  the  thrusters  fire  to 
reduce  the  dead  band,  and  the  reaction  wheel  drive  motors  are  turned  on. 


2. 2. 1.4  Reacquire  References  -  Level  3/Category  I.  Reference 

reacquisition  repeats  the  initial  acquisition  from  the  point  where  the 
specified  reference  is  lost.  If  the  sun  is  lost,  see  2. 2. 1.1.  If  the  earth 
is  lost  see  2.2. 1.2.  Before  reacquiring  the  sun,  the  qround  must  drive  the 
solar  arrays  to  the  noon/midnight  position.  Sun  reacquisition  is  autonomous 
unless  disabled.  Earth  reacquisition  must  be  ground  enabled.  The  gyro  for 
yaw  rate  control  is  turned  on  by  the  ground.  This  gyro  is  most  often  used  for 
reacquisition,  but  can  also  be  used  as  a  backup  to  the  sun/earth  sensors  for 
yaw  sensing. 


2.2.2  Maintain  Stable  Attitude  During  Normal  Operations 

2. 2. 2.1  Determine  Attitude  -  Level  3/Category  I. 

2. 2. 2. 1.1  Sense  Attitude  Relative  to  Sun.  The  pitch  sun  sensor  measures 
the  sun  location  relative  to  the  S/C.  The  roll  sun  sensor  provides  yaw 
information  except  near  noon  or  midnight,  when  the  sun  sensor  provides  only 
roll  information.  Solar  array  position  information  is  from  the  solar  array 
drive  pot. 


2. 2. 2. 1.2  Sense  Attitude  Relative  to  Earth.  The  earth  sensor  provides 
pitch  and  roll  information.  During  solar  eel i pse  only  earth  sensor  data  is 
used  for  attitude  control. 


2. 2. 2. 1.3  Analyze  Pitch,  Roll,  Yaw  Position.  The  ACS  logic  computes 
attitude  from  sun  sensor  and  earth  sensor  inputs. 


2. 2. 2. 1.4  Sense  Reaction  Wheel  Speed.  The  speed  of  each  reaction  wheel  is 
sensed  by  a  tachometer.  The  ACS  logic  converts  the  tachometer  rate  to  a 
momentum  equivalent  rate  (MER)  for  directing  wheel  unloading.  Unload  timing 
is  derived  from  the  solar  array  drive  pot  angle. 
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2. 2. 2. 2 


Direct/Control  Attitude  Maintenance. 


2. 2. 2. 2.1  Select  Control  Loop  Parameters  -  Level  4/Category  I.  The  ACS 

selects  both  outer  and  inner  loops  with  the  outer  loop  in  the  16  second  update 
mode  and  the  inner  loop  in  its  normal  1  second  update  mode. 


2. 2. 2. 2. 2  Control  Reaction  Wheel  Momentum  -  Level  4/Category  I.  The  ACS 
control  logic  directs  reaction  wheel  change.  It  processes  tachometer  signals 
in  the  pitch,  roll,  yaw  estimator  and  sends  a  corrective  control  signal. 
(Tachometer  selection  is  done  by  the  ground).  The  logic  computes  the  nominal 
roll  acceleration  (RACC)  disturbance  and  feeds  it  to  the  ACS  roll  estimation 
to  minimize  roll/yaw  error  near  noon  and  midnight.  The  ACS  controls  the 
reaction  wheels  by  providing  motor  drive  signals.  Reaction  wheel  speeds  are 
redistributed  for  momentum  balancing  and  gain  compensation. 


2. 2. 2. 2. 3  Manage  Reaction  Wheel  Momentum  -  Level  4/Category  I.  When  one 
reaction  wheel  tachometer  senses  that  its  speed  is  less  than  250  rpm,  momentum 
can  be  distributed  to  slow  down  other  wheels  and  speed  that  one  up. 

Similarly,  a  wheel  running  too  fast  is  slowed  down  by  transferring  momentum  to 
other  wheels.  Momentum  management  is  conducted  automatically. 


2. 2. 2. 2. 4  Manage  Control  Parameters  -  Level  0/Category  I.  Control 

parameters  are  stored  in  the  ACS  and  are  occasionally  modified  by  the  ground. 
If  necessary,  the  ACS  automatically  reloads  these  parameters.  The  active 
random  access  memory  (RAM)  is  reloaded  from  the  radiation  hardened  RAM.  The 
reloadable  parameters  are:  commanded  dead  bands,  pulse  widths,  wheel  unload 
windows,  bias  for  pitch  momentum,  solar  array  misalignment,  sun  declination 
bias  values,  position  gains  and  momentum  equivalent  rate,  wheel  integral 
terms,  RACC  values,  and  certain  flags  for  processing. 


2. 2. 2. 2. 5  Direct  Reaction  Wheel  Unloading  -  Level  4/Category  I.  The  ground 
selects  0600  or  1800  as  the  unloading  time  (unloading  may  be  done  once  or 
twice  daily,  as  required).  The  ACS  checks  the  MER  against  the  dead  band  limit 
and  issues  commands  for  thruster  firings. 


2. 2. 2. 2. 6  Select  Thrusters  -  Level  2/Category  II.  The  ground  selects 
thrusters  so  that  aV  induced  by  reaction  wheel  unloading  is  directed  to  offset 
East/West  drift,  thereby  aiding  East/West  stationkeeping. 


2. 2. 2. 3  Control  Attitude  -  Level  4/Category  I. 


2. 2. 2. 3.1  Change  Reaction  Wheel  Speed.  Selected  reaction  wheels  are 

driven  by  motors  to  maintain  spacecraft  attitude.  Reaction  wheels  speed  up  or 
slow  down,  as  required,  and  momentum  can  be  traded  between  wheels.  Reaction 
wheels  control  attitude  in  all  axes. 
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2. 2. 2. 3. 2  Unload  Reaction  Wheels.  Selected  thrusters  pulse  to  transfer 

momentum  from  the  reaction  wheels,  which  are  allowed  to  slow  down.  Thrusters 
fire  every  64  cycles  until  the  MER  is  less  than  the  dead  band. 


2.2.3 


Maintain  Stable  Attitude  During  Maneuvers  -  See  2. 7. 4. 2 


2.3  PROVIDE  THERMAL  CONTROL* 

The  basic  thermal  control  subsystem  design  uses  passive  thermal 
control  techniques  to  control  the  energy  balance  between  the  spacecraft  and 
space,  thus  controlling  the  temperature  level  of  the  spacecraft  and  its 
components.  The  active  thermal  control  components  are  used  to  maintain  the 
internally  generated  energy  at  a  level  such  that  the  temperature  of  the 
spacecraft  and  its  components  are  kept  within  operational  limits  even  when 
internally  generated  heat  varies  or  when  there  are  variations  in  the  energy 
level  of  external  sources. 

The  passive  thermal  control  design  does  not  use  any  semi -active 
equipment  (louvres,  heat  pipes,  etc.).  Thus,  once  the  design  is  finalized, 
assembled,  and  tested,  the  temperature  level  of  the  spacecraft  and  its 
components  is  defined  and  controlled  by  the  spacecraft  power  state  and  orbit 
condition  relative  to  sun  angle,  inclination,  and  spacecraft  orientation  and 
there  is  no  capability  for  any  change  in  designed  control  temperature  level. 
Figure  2-4  shows  the  Thermal  Control  function  hierarchy. 


2.3.1  Provide  Prelaunch  Phase  Thermal  Control 
Provide  and  manage  air  conditioning  systems. 

2.3.2  Provide  Launch  Phase  Thermal  Control 

During  the  launch  phase  the  system  relies  on  its  own  heat 
capacitance  to  protect  against  cold. 


2.3.2. 1 


2. 3. 2. 2 

2.3.3 

2. 3. 3.1 

2. 3. 3. 2 

Heaters 


2.3.4 


Enable  Survival  Heaters  -  Level  3/Category  I. 

Enable  Control  Heaters  -  Level  3/Category  1. 

Provide  Orbit  Transfer  Phase  Thermal  Control 

Enable  Survival  Thermostats  -  Level  3/Category  I. 

Enable  Battery,  Propulsion  and  Solar  Array  Actuator  (SAA) 
Level  3/Category  it 

Provide  On-Orbit  Thermal  Control 
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Figur-e  2-4.  Thermal  Control  Service  Functional  Hierarchy 


The  active  thermal  control  components  are  divided  into  two 
functions;  a  control  function  that  is  designed  to  be  commanded  on,  and  a 
survival  function  that  is  always  on. 


2. 3. 4.1  Control  Electric  Compensation  Heaters  -  Level  3/Category  I. 

2. 3. 4. 1.1  Sense  Temperature.  Temperature  sensor  set  points  are  hard  wired 
and  are  tailored  to  the  specific  component  served. 


2. 3. 4. 1.2  Oirect/Control  Temperature  Maintenance.  The  Low  Noise  Amplifier 
(LNA)  oven  has  an  electronic  thermostat  for  control  while  its  survival  heaters 
use  mechanical  thermostats.  The  north  and  south  sun  sensor  assemblies  use 
three  electronic  thermostats  in  parallel.  The  three  thermostats  sample  the 
temperature  of  the  sun  sensor  assembly,  and  the  sun  sensor  assembly 
temperature  is  controlled  by  the  thermostat  whose  temperature  falls  in  the 
middle  of  the  three  readings.  The  ground  monitors  temperature  and  can 
enable/disable  heaters  to  control  temperature  and  power  consumption. 


2. 3. 4. 1.3  Heaters  Switch.  The  heaters  autonomously  switch  on  or  off  to 
maintain  temperature  in  the  required  range. 


2. 3. 4. 2  Control  Catalyst  Bed  Heaters  -  Level  1 /Category  I.  Catalyst  bed 

heaters  must  be  turned  on  for  100  minutes  prior  to  thruster  firing  (see 
2. 1.1. 3,  7. 4. 1.3).  Catalyst  bed  minimum  temperatures  are:  140°C  normal 
operation;  82°C  North-South  stationkeeping  maneuvers;  40°  post-launch 
initialization  and/or  emergency. 


2. 3. 4. 3  Control  Survival  Heaters  -  Level  3/Category  I. 

2. 3. 4. 3.1  Sense  Temperatures .  The  survival  thermostats  are  activated 
whenever  temperatures  fall  below  specified  limits. 


2. 3. 4. 3. 2  Direct/Control  Survival  Heaters.  The  survival  heaters  are 
completely  autonomous  and  cannot  be  controlled  by  the  ground.  Hard  wired 
circuits  activate  the  battery,  sun  sensor  assembly  (SSA)  and  propulsion 
heaters  autonomously. 


2. 3. 4. 3. 3  Heaters  Switch.  The  survival  heaters  switch  on/off  autonomously 
to  maintain  the  temperature  above  the  required  limits.  Activation  of  the  load 
shed  relay  (a  power  function  described  in  Sections  3.1.1  and  4.2.1)  does  not 
disable  these  heaters. 
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2.4  PROVIDE  SPACECRAFT  CONTROL  AND  MONITORING  FUNCTION* 


to: 


The  purpose  of  the  spacecraft  control  and  monitoring  function  is 


(1)  acquire,  condition,  format  and  transmit  satellite  telemetry 
data  from  the  spacecraft  to  the  qround,  and 

(2)  receive,  decode  and  distribute  commands  from  the  qround  to 
the  spacecraft. 

Concurrently ,  the  SHF  telemetry  downlinks  are  also  used  to 
provide  a  payload-d°nved  network  timinq  siqnal  and  a  ground  antenna  pointinq 
beacon  to  certain  canm  system  users. 

The  spacecraft  control  and  monitoring  system  is  currently 
implemented  in  the  Telemetry,  Tracking  and  Command  Subsystem  (TT&C)  on  the 
spacecraft,  and  in  the  Satellite  Control  Facility  (SCF)  on  the  ground. 

The  personnel  and  facilities  of  the  ground  system  monitor  the 
S/C  via  the  RF  links.  Providing  the  means  of  controlling  the  S/C  via  the 
command  link,  monitoring  the  S/C  over  the  telemetry  link,  and  determining  the 
orbit  by  the  two  way  tracking  link  are  the  functions  of  the  TT&C  subsystem. 
Determination  of  the  commands  to  be  sent,  the  S/C  performance  and  the  orbit 
are  ground  decisions  and  functions  of  other  subsystems,  except  where  the 
information  relates  to  the  TT&C  subsystem.  Figure  2-5  shows  the  hierarchy  of 
spacecraft  control  and  monitoring  functions. 

Most  of  the  command,  telemetry  and  tracking  services  are 
performed  autonomously.  For  example,  the  S/C  autonomously  acquires  and  issues 
commands.  However,  the  qround  based  function  is  required  to  send  the  command 
information.  Tracking  is  a  function  related  to  stationkeepinq  and  is 
described  as  part  of  the  Stationkeeping/Navigation  Function  in  Section  2.7.1. 


2.4.1  Provide  Telemetry  Function 

This  function  provides  the  service  of  acquiring,  generating  and 
transmitting  the  S/C  telemetry  parameters  to  the  qround.  This  function  also 
provides  for  the  reception,  processing  and  distribution  of  the  S/C  telemetry 
information  on  the  ground.  The  DSCS  III  S/C  telemetry  service  function,  as 
currently  planned,  is  basically  autonomous.  The  S/C  acquires  and  sends 
telemetry  without  help.  However,  ground  support  is  required  to  request 
transmission  of  the  data,  and  to  process  and  analyze  the  data. 


2. 4. 1.1  Acquire  Information  -  Level  3/Category  I.  The  Master  Telemetry 

Unit  (MTU)  acquires  information  from  four  other  spacecraft  subsystems:  the 
Communication  Payload  (COMM),  the  Attitude  Control  Subsystem  (ACS),  the  Single 
Channel  Transponder  (SCT),  and  the  Electric  Power  Distribution  System  (EPDS). 
It  acquires  information  indirectly  from  three  additional  subsystems  through 
one  or  more  of  the  above  subsystems.  These  additional  sources  are  the  Thermal 
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Figure  2-5.  Spacecraft  Control  and  Monitoring  Service  Functional  Hierarchy 


Control  Subsystem  (TCS),  the  Propulsion  Subsystem  (PROP),  and  the 
Structural/Mechanical  Subsystem.  The  Remote  Telemetry  Unit  (RTU)  acquires 
information  from  North  Panel  sensor  sources.  { 

2. 4. 1.1.1  Acquire  Analog  Data.  The  MTU  receives  192  analog  inputs.  The 
RTU  receives  128  anal og  i nputs.  Analog  measurement  inputs  from  subsystem 
sensor  sources  are  accessed  by  the  MTU  and  RTU  via  dedicated  lines  from  these 
sources.  Signals  are  provided  continuously  on  each  dedicated  line  from  each 
subsystem  sensor  source  for  interrogation  by  the  MTU  and/or  RTU.  No  direction 
or  action  is  necessary  since  the  required  analog  data  is  continuously 
available  on  dedicated  lines  at  the  MTU  and  RTU  inputs. 


2. 4. 1.1. 2  Acquire  Bi-Level  Data.  The  MTU  receives  350  bi-level  digital 

inputs.  The  RTU  receives  140  bi -level  digital  inputs.  Bi-level  measurement 
inputs  from  subsystem  sensor  sources  are  accessed  by  the  MTU  and  RTU  via 
dedicated  lines  from  these  sources.  Signals  are  provided  continuously  on  each 
dedicated  line,  from  each  subsystem  sensor  source,  for  interrogation  by  the 
MTU  and/or  RTU.  No  direction  or  action  is  necessary  since  the  required 
bi-level  data  is  continuously  available  on  dedicated  lines  at  the  MTU  and  RTU 
i nputs. 


2. 4. 1.1. 3  Acquire  Serial  Digital  Data.  The  MTU  receives  two  23-bit  serial 

digital  and  sixteen  8-bit  serial  digital  inputs.  The  RTU  receives  no  serial 
digital  measurement  inputs.  Serial  digital  measurement  inputs  from  subsystem 
sources  are  accessed  by  the  MTU  via  dedicated  lines  from  subsystem  sensor 
sources.  Signals  are  provided  on  a  given  line  only  upon  request  by  the  MTU. 
Acquisition  of  serial  digital  measurement  signals  from  subsystem  sources  by 
the  MTU  is  initiated  and  controlled  by  appropriate  logic  control  and  timing 
circuits  in  accordance  with  a  predetermined  sequence  stored  in  Programmable 
Read-Only  Memory  (PROM).  The  MTU  provides  enable  and  clock  signals  over 
dedicated  lines  to  a  subsystem  source  when  readout  of  a  serial -digital 
measurement  is  desired. 


2. 4. 1.2  Generate  Telemetry  -  Level  3/Category  I.  Following  acquisition 

of  information,  the  major  functions  performed  in  the  generation  of  a  telemetry 
data  output  stream  are  (1)  multiplexing  of  analog  data,  (2)  digitization  of 
analog  data,  (3)  multiplexing  of  digital  data,  and  (4)  formatting  of  data. 


2. 4. 1.2.1  Multiplex  Analog  Data.  The  MTU  provides  time  division 

multiplexing  of  analog  input  data  from  spacecraft  subsystem  sensor  sources  and 
the  RTU.  The  RTU  provides  time  division  multiplexing  of  analog  data  from 
North  Panel  sensor  sources.  The  output  of  the  RTU  analog  multiplexer  is  routed 
to  the  MTU  analog  multiplexer  for  multiplexing  with  other  analog  measurements 
accessed  by  the  MTU. 

Analog  measurement  inputs  are  provided  directly  to  dedicated 
analog  switches  in  an  analog  multiplexer  via  dedicated  lines  from  subsystem 
sensor  sources.  Interrogation  of  analog  measurement  signal  lines  by  the  MTU 
and/or  RTU  is  initiated  and  controlled  by  appropriate  logic  control  and  timing 
circuits  in  accordance  with  a  predetermined  sequence  stored  in  PROM.  Analog 
switches  are  selectively  closed  and  the  associated  input  measurement  lines 


connected  to  the  MTU  analog  multiplexer  output  so  that  a  single  output  line 
containing  time-division  multiplexed,  analog  data  results. 

2. 4. 1.2. 2  Digitize  Analog  Data.  Analog  samples  to  be  digitized  are 
Sequentially  provided  at  the  output  of  the  MTU  analog  multiplexer.  Timing  and 
logic  control  circuits  in  the  MTU  provide  signals  to  determine  the  sample 
availability  for  the  digitization  and  to  initiate  and  control  the  digitization 
process  for  each  sample.  Each  analog  sample  is  digitized  into  an  8-bit  word 
by  an  anal og-to-di gi tal  converter  (ADC)  in  the  MTU. 

2. 4.1.2’. 3  Multiplex  Digital  Data.  Digital  data  is  accessed  from  (1)  the 

MTU  ADC,  (2)  the  dedicated  bi-level  digital  source  lines  accessed  by  the  MTU, 
(3)  the  output  of  the  RTU  bi-level  digital  data  multiplexer,  and  (4)  the 
dedicated  serial -digi tal  data  lines. 

Digital  measurements  from  the  aforementioned  sources  are 
provided  via  dedicated  lines  to  the  inputs  of  dedicated  digital  switches  in 
the  MTU  digital  multiplexer.  Interrogation  of  digital  measurement  signal 
lines  by  the  MTU  is  initiated  and  controlled  by  appropriate  logic  control  and 
timing  circuits  in  accordance  with  a  predetermined  sequence  stored  in  PROM. 
Digital  switches  are  selectively  closed,  and  the  associated  input  measurement 
lines  are  connected  to  the  MTU  digital  multiplexer  output  so  that  a  single 
output  line  containing  time-division  multiplexed  digital  data  results. 


2. 4. 1.2. 4  Format  Data.  A  single  multiplexed  digital  data  stream  is 

provided  at  the  output  of  the  MTU  digital  multiplexer  for  formatting  into  main 
and  master  telemetry  output  frames.  Timing  and  logic  control  circuits  in  the 
MTU  provide  signals  to  generate  header  information  and  execute  the  formatting 
process  in  accordance  with  a  sequence  stored  in  PROM.  The  digital  data  output 
stream  from  the  MTU  digital  multiplexer  is  formatted  into  main  frames  each 
consisting  of  256  8-bit  telemetry  words  and  master  frames  each  consisting  of 
30  main  frames.  The  output  bit  rate  is  1000  bps  resulting  in  a  main  frame 
period  of  2.048  seconds  and  a  master  frame  period  of  61.44  seconds.  The 
formatted  digital  data  output  stream  from  the  MTU  is  routed  to  the  TT&C  RF 
equipment  for  transmission  to  the  ground. 


2. 4. 1.3  Send  Telemetry  (S/C)  -  Level  3/Category  II.  This  function  is 

provided  by  the  DSCS  III  S/C  for  transmission  of  S/C  data  to  the  ground 
stations.  The  S/C  data  is  acquired  from  the  various  subsystems  by  the  TT&C 
subsystem  and  generated  into  a  format  suitable  for  sending  on  the  RF 
downl i nk . 


The  S-Band  and  SHF  RF  signals  have  virtually  identical  telemetry 
data  modulated  on  them.  These  links  can  be  used  interchangeably  but  generally 
are  used  in  specific  ways.  The  S-Band  telemetry  RF  link  from  the  S/C  to  the 
Satellite  Control  Facility  (SCF)  Remote  Tracking  Stations  (RTS)  is  primarily 
used  for  normal  status  and  health  telemetry  information.  The  X-Band  link 
to  the  EDM-SCCE  DSCS  ground  station  is  primarily  used  for  payload  status  and 
configuration  and  health  monitoring. 

Both  the  S  and  X-Band  RF  links  "send  telemetry"  autonomously. 
That  is,  after  the  appropriate  hardware  is  turned  on  by  ground  command,  the 


telemetry  is  modulated  on  the  RF  carrier  and  transmitted  via  one  of  the  S/C 
antennas  to  the  ground  stations. 

2. 4. 1.3.1  Send  S-Band  Telemetry.  For  sending  S-Band  telemetry,  a  digital 
telemetry  signal  is  received  from  the  Master  Telemetry  Unit  (MTU).  This 
signal  is  encrypted  and  then  modulated  on  a  suhcarrier.  This  composite  signal 
is  modulated  on  the  carrier.  The  modulated  carrier  is  then  multiplied  up  in 
frequency,  amplified  and  transmitted  to  the  ground. 

In  the  normal  operating  mode  the  downlink  telemetry  is  estivated 
by  the  uplink  command  function  as  follows:  uplink  receiver  and  command  lock 
are  obtained;  command  "S-Pulses"  are  modulated  in  the  uplink;  the  detector 
locks  to  the  S-Pulses  and  outputs  an  "AM- Sync"  to  the  command  decoder  (CD); 
the  CD  outputs  a  signal  to  the  South  Power  Controller  (SPC);  the  SPC  turns  on 
a  number  of  items,  including  the  S-Band  transmit  function.  The  transmitter 
also  can  be  turned  on  by  ground  command.  The  S-Band  transmitter  is  normally 
"off"  until  activated  by  the  ground.  The  S-Band  transmitter  may  also  be 
turned  on  continuously  by  ground  command. 

Also,  the  transmitter  can  be  automatical ly  turned  on  by  loss  of 
"earth  presence"  via  the  attitude  control  function.  The  power  system  "80 
minute  timer"  can  activate  the  downlink.  The  separation  timer  can  activate 
the  S-Band  downlink  during  the  launch  phase. 

The  function  of  sending  telemetry  over  the  RF  link  to  the  ground 
is  basically  autonomous  and  free  of  ground  intervention  as  currently  designed 
in  DSCS  III.  The  link  does  need  to  be  activated  by  uplink  command  actions 
from  the  ground. 


2. 4. 1.3. 2  Send  X-Band  (SHF)  Telemetry.  To  send  X-Band  telemetry,  data  is 

first  received  from  the  MTU.  The  data  is  then  encrypted  and  mixed  with  a 
Pseudo-Noise  (PN)  code  and  clock.  This  composite  signal  is  modulated  on  a 
stable  carrier  derived  from  the  comm  subsystem  frequency  reference,  multiplied 
to  X-Band  and  transmitted  out  of  one  of  the  payload  antennas.  The  composite 
signal  contains  network  timing  information  and  the  stable  carrier  provides  a 
pointing  reference  for  comm  system  user  ground  antennas. 

The  SHF  telemetry  is  sent  (transmitted)  by  two  active  and 
redundant  X-Band  beacons  operating  at  different  frequencies  over  different 
comm  subsystem  antennas.  The  beacons  are  normally  on  but  can  be  turned  on  and 
off  as  required  by  ground  command.  The  beacons  are  automatically  turned  off 
by  the  "80  minute  timer"  or  the  loss  of  "earth  presence"  sensor. 

The  function  of  sending  telemetry  over  the  X-Band  RF  link 
basically  is  accomplished  without  ground  intervention.  Once  the  link  is 
turned  on  and  set  to  the  desired  operating  mode,  the  telemetry  is  returned 
without  further  action  by  ground  based  operations. 


2. 4. 1.4  Receive  Telemetry  (Ground  Segment).  The  S/C  transmitted 

telemetry  signal  is  received  on  the  ground  by  S  and  X-Band  ground  stations. 
The  SCF  receives  data  from  the  S-Band  stations  and  uses  this  data  for  general 
health  and  status  information  on  the  S/C.  The  X-Band  signal  is  received  by 
the  DSCS  III  stations  and  processed  through  the  EDM-SCCE.  The  payload  users 


also  receive  the  X~Band  telemetry  siqnals.  EDM-SCCE  and  the  payload 
users  use  the  telemetry  data  for  payload  status  information. 


2. 4. 1.4.1.  Receive  S-Band  Telemetry.  The  reception  of  telemetry  is 
accomplished  by  deciding  which  S/C  and  which  frequency  will  be  used  (typically 
the  S/C  "A"  string);  pointing  the  antenna  and  transmitting  an  uplink  signal  to 
the  S/C  with  S-Puise  command  modulation;  confirming  that  the  "AM  Sync" 
activated  by  the  S-Pulse  data  has  turned  on  the  S-Band  downlink;  acquiring  the 
downlink  S-Band  signal;  demodulating  the  1.024  MHz  subcarrier  from  the 
carrier;  demodulating  the  data  from  the  subcarrier;  decrypting  the  data;  and, 
conditioning  the  data  for  processing. 


2. 4. 1.4. 2  Receive  X-Band  (SHF)  Telemetry.  The  SHF  telemetry  signals 
transmitted  by  both  of  the  S/C  X-band  beacons  are  received  by  the  primary 
EDM-SCCE  stations  and  the  payload  users.  The  data  is  used  primarily  for 
payload  related  functions  (any  payload  problems  are  referred  to  SCF  for 
resolution  over  the  S-Band  link).  Both  of  the  redundant  X-Band  beacons  are 
normally  on,  transmitting  at  different  frequencies  over  different 
communications  subsystem  antennas.  To  use  these  signals,  the  ground  stations 
determine  which  frequency  to  receive,  and  where  to  point  their  antennas  to 
acquire  the  beacon  downlink  siqnal  (which  is  a  spread  spectrum,  ‘suppressed 
carrier  signal  modulated  with  PN,  clock  and  data).  The  clock  and  PN  code  are 
acquired  and  the  data  stripped  off.  The  data  is  decrypted  and  conditioned  for 
processing . 


2. 4. 1.5  Process  S/C  Telemetry  (Ground).  The  following  discussion  is 

applicable  to  S/C  health  and  welfare  information  only.  Payload  data 
processing  is  not  discussed  herein. 

The  modulated  RF  telemetry  signal  transmitted  from  the 
spacecraft  is  received  by  the  RTS  over  the  S-Band  or  SHF  telecommunications 
channel.  The  RTS  uses  an  analog  tape  recorder  to  store  the  received  telemetry 
signal.  The  stored  data  is  subsequently  1)  read  from  tape,  2)  demodulated,  3) 
decrypted,  and  4)  routed  to  the  RTS  Univac  1230  computer. 

At  this  point,  the  data  is  then  decommutated  wherein 
individually  selected  measurement  data  is  separated  from  the  composite 
telemetry  stream  for  processing.  Selected  measurements  are  limit  checked  to 
provide  definitive  information  on  spacecraft  health  status.  The  Satellite 
Test  Center  (STC)  provtoC-?  telemetry  processing  requirements  in  the  form  of 
ground  telemetry  modes  prior  to  each  RTS  station  pass.  These  modes  are 
specified  in  the  form  of  pre-canned  telemetry  mode  software  and  are  used  to 
process  subsets  of  telemetry  data  where  each  is  associated  with  a  particular 
spacecraft  function  assessment.  (See  5.0) 


2. 4. 1.6  Distribute  Data  (Ground).  The  RTS  sends  processed  telemetry  and 
alarm  violation  data  to  the  Mission  Control  Complex  (MCC)  of  the  STC  where  it 
is  stored  and  selectively  displayed  for  analysis.  (See  5.0) 
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2. 4. 1.7  Analyze  Spacecraft  Information  (Ground).  The 
the  RTS  is  analyzed  by  MCC  operations  personnel  for  routine 
action  decisions  under  the  overall  direction  of  the  Mission 
5.0) 


data  received  from 
or  contingency 
Controller.  (See 


2.4.2  Provide  Command  Function 

The  command  function  provides  the  service  of  acquiring  and 
sending  commands  to  the  S/C  by  the  ground  segment  and  the  reception  and 
execution  of  these  commands  by  the  S/C.  The  ground  based  operations  determine 
the  commands  which  need  to  be  sent,  acquire  the  command  instructions,  generate 
the  command  data,  and  transmit  the  command  data.  The  spacecraft  receives  and 
detects  this  transmitted  data,  processes  the  command  data  (decodes),  and 
issues  command  instructions  to  the  subsystems. 

The  command  transmission  (qround  seqment)  and  command  reception 
(space  seqment)  is  accomplished  over  two  functionally  identical,  but 
independent  systems.  One  is  an  S-Band  system  used  for  general  health, 
maintenance,  and  status  changes  on  the  S/C  from  the  Satellite  Control  Facility 
(SCF).  This  includes  health  and  maintenance  functions  of  the  payload.  The 
second  is  the  X-Band  System  which  is  used  for  operations  with  the  payload. 
These  X-Band  (SHF)  payload  commands  are  normally  transmitted  by  the  DSCS  111 
ground  system  (EDM-SCCE).  Both  links  will  perform  identical  command  functions 
and  each  serves  as  a  backup  to  the  other. 

The  DSCS  III  command  function  on  the  S/C  is  basically 
autonomous.  Once  the  ground  system  has  established  the  command  path  the  S/C 
will  receive  and  execute  the  qround  transmitted  instructions. 


2. 4. 2.1  Acquire  Instructions  (Ground).  The  first  step  in  the  command 
processes  is  the  decision  by  operations  personnel  on  what  commands  or 
instructions  need  to  be  transmitted  to  the  S/C.  By  established  operational 
procedures  these  instructions  are  gathered  and  put  into  a  form  such  that  the 
ground  system  can  'generate'  the  command  data.  The  acquisition  and  subsequent 
decisions  on  what  commands  need  to  be  sent  have  to  be  carefully  coordinated  by 
the  two  somewhat  independent  ground  operations,  the  S-Band  SCF  and  the  SHF 
system  EDM-SCCE.  Both  of  these  systems  can  issue  commands.  However,  the  DCA 
does  maintain  executive  control  over  the  operations  system. 

2. 4. 2. 2  Generate  Commands  (Ground).  Once  the  command  instructions  are 
acquired  and  the  operations  personnel  have  determined  the  commands  to  be  sent 
and  the  command  sequences,  the  actual  commands  have  to  be  generated  in 
preparation  for  transmission.  The  basic  command  instructions  and  the  sequence 
of  the  instructions  is  processed  and  a  command  data  set  is  generated.  This 
generated  command  data  set  is  then  forwarded  by  the  SCF  or  EDM-SCCE  to  the 
appropriate  stations  for  transmission  to  the  satellite. 
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2. 4. 2. 3  Send  Commands  (Ground).  There  are  two  qround  segment  systems 

used  for  sending  commands  to  the  S/C.  One  is  the  S-Band  (SGLS)  System 
controlled  from  SCF  and  the  other  is  the  X-Band  (SHF)  system  controlled  from 
EDM-SCCE.  Payload  related  commands  normally  are  sent  via  the  SHF  system. 
Health,  maintenance  and  general  S/C  commands  are  sent  via  the  S-Rand  system. 


2. 4. 2. 3.1  Send  S-Band  Commands.  Before  commands  can  he  sent  to  the  S/C  the 
command  instructions  are  acquired  and  the  command  siqnals  formatted  and 
qenerated.  For  sendinq  commands,  this  data  is  then  encrypted  and  modulated  on 
an  S-Band  carrier  at  the  SCF  qround  stations.  The  modulated  carrier  is  then 
transmitted  to  the  S/C.  The  carrier  is  phase  modulated  by  a  three  tone  (S,  0, 
1)  AM-PCM/FSK  command  signal.  The  uplink  is  first  modulated  with  S-hit  tones 
which  cause  the  S/C  to  activate  some  of  the  command  channel  hardware.  The 
transmitter  frequency  is  chosen  to  select  the  S/C  "A"  or  "B"  command  channel 
(redundant  channels). 


2. 4. 2. 3. 2  Send  X-Band  (SHF)  Commands.  Before  commands  can  be  sent  to  the 
S/C,  the  command  instructions  have  to  be  acquired.  These  instructions  are 
then  formatted  and  command  data  generated.  For  sending  commands,  this  command 
data  is  then  encrypted  and  modulated  on  an  X-Band  (SHF)  carrier.  The  EDM-SCCE 
controlled  DSCS  III  X-Band  stations  then  transmit  the  modulated  carrier  to  the 
S/C.  The  redundant  S/C  command  channels  (A  and  B)  are  selected  by  selection 
of  the  transmitter  frequency. 


2. 4. 2. 4  Receive  Commands  (Space  Segment)  -  Level  3/Category  II. 

Commands  can  be  received  over  the  S-Band  or  the  X-Band  (SHF)  paths.  Roth 
paths  are  fully  block  redundant  and  selection  of  the  redundant  path  is  by 
selection  of  the  ground  transmitting  frequency. 

In  the  S-Band  link  the  redundant  riecrypt.ers  are  continuous  in 
operation  so  that  the  failure  of  a  single  riecrypter  still  leaves  an  operating 
S-Band  command  channel.  At  X-Band,  only  one  decrypter  can  be  on  at  one  time 
and  there  is  no  autonomous  mechanism  for  turning  on  the  other.  If  an  X-Band 
decrypter  fails  the  redundant  one  must  be  activated  by  an  S-Band  command 
before  an  X-Band  command  channel  is  again  available. 

Once  the  command  links  are  established  by  the  ground,  the  S/C 
command  receiving  function  autonomously  performs  the  reception  and  detection 
of  command  data. 
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2. 4. 2. 4.1  Receive  S-Band  Commands.  The  command  data  modulated,  S-Band 
carrier  transmitted  from  the  qround  is  received  over  one  of  the  two,  hybrid, 
connected  antennas.  The  received  signal  is  provided  to  both  receivers,  one  of 
which  automatically  acquires  the  carrier  and  demodulates  the  composite  command 
signal.  The  receiver  is  selected  by  selection  of  the  ground  transmitter 
frequency.  The  receiver  command  detector  then  converts  the  composite  signal 
to  data.  The  first  data  sent  is  S-bits.  The  S-bits  activate  the  AM-Sync  in 
the  receiver  detector.  The  AM-Sync  activates  the  decrypters,  the  MTU  and  the 
S-Band  transmitters  (the  command  decoder  is  chosen  by  the  command  preamble 
word).  After  activation,  the  received  command  information  is  detected  and 
decrypted  and  sent  to  the  command  decoder  for  processing. 

The  S/C  performs  the  receive  command  function  autonomously.  It 
receives,  demodulates,  detects,  decrypts  and  sends  the  command  data  to  the 
command  decoder  without  ground  intervention. 


2. 4. 2. 4. 2  Receive  X-Band  Commands.  The  ground  transmitted  X-Band  carrier 

modulated  with  command  data  is  received  by  the  S/C  over  one  of  three  antennas 
and  one  of  two  redundant  receivers.  If  the  SHF  channel  1  frequency  is 
transmitted,  either  the  multibeam  antenna  (MBA)  or  the  earth  coverage  horn 
antenna  #2  (E2R)  can  be  selected  to  provide  the  signal  to  the  channel  1 
receiver  ("B"  receive  path).  If  channel  5  is  transmitted,  the  signal  is 
received  over  the  earth  coverage  horn  antenna  #1  (E1R)  and  receiver  "A".  The 
antennas  and  components  prior  to  the  input  to  the  TT&C  receivers  are  part  of 
the  payload  communications  subsystem.  The  TT&C  subsystem  receivers  also  get 
frequency  references  from  the  comm  subsystem.  The  X-Band  signal  received  from 
the  antennas  is  down  converted  to  a  lower  frequency  and  provided  to  the 
decrypters  for  command  demodulation,  detection  and  decryption.  The  decrypted 
(plain  text)  command  data  then  is  conditioned  and  sent  to  the  command  decoder 
for  processing  and  issuance  of  command  instructions  to  the  S/C  subsystems. 

The  X-Band  channel  is  functionally  identical  to  the  S-Band 
command  channel  and  the  two  can  be  used  interchangeably.  However,  the  X-Band 
channel  normally  is  used  only  for  payload  related  commands. 

The  S/C  performs  the  command  function  autonomously.  After  the 
signal  arrives  at  the  antenna  it  is  processed  without  further  intervention 
from  the  qround. 


2. 4. 2. 5  Process  Commands  -  Level  3/Category  I.  The  Command  Decoder 

(CD)  receives  commands  from  both  the  TT&C  S-Band  and  SHF  equipment  and 
provides  the  necessary  processing  that  must  be  accomplished  prior  to  their 
distribution  and  execution. 
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2. 4. 2. 5.1  Route  Encrypted  S-Band  Commands.  AM  Sync  is  provided  to  the  CD 

by  the  S-Band  transponder  via  a  dedicated  line  when  command  modulation  is 
present.  Demodulated,  but  encrypted  command  data  is  provided  to  the  CD  by  the 
S-Band  receiver  over  four  separate  lines  (S,  1,  0  and  clock).  Using  the  AM 
sync  signal,  the  CD  turns  on  the  S-Band  decrypters.  Encrypted  S-Band  command 
data  (S,  1,  0,  and  clock)  from  the  S-Band  receiver  is  then  routed  through  the 
CD  to  the  S-Band  decrypters.  When  AM  sync  is  lost,  a  power  off  signal  is 
output  from  the  CD  to  disable  the  decrypters. 


2. 4. 2. 5. 2  Acquire/Check  Plain-Text  Data.  Plain-text  command  data  is 
provided  to  the  CD  from  either  of  the  S-Band  decrypters  or  from  the  single 
operating  SHF  decrypter  in  the  TT&C  RF  equipment.  Only  one  of  two  SHF 
decrypters  is  on. 

Plain-text  command  data  is  provided  to  the  CD  in  a  4  signal 
format  of  S,  1,  0,  and  clock  over  dedicated  lines  at  rates  of  500  bps  from  the 
S-Band  channel  and  100  bps  from  the  SHF  channel.  Validity  checks  and  priority 
determination  are  performed  on  the  incoming  command  data  prior  to  command 
decodi ng. 


2. 4. 2. 5. 3  Determine  Command  Type.  Following  validation  and 

prioritization,  the  CD  determines  the  command  type  from  information  contained 
within  the  received  plain-text  command.  The  first  five  bits  of  a  plain-text 
command  provided  to  the  CD  indicate  the  command  type.  There  are  the  following 
six  command  types: 

(1)  CD  configuration  command 

(2)  Discrete  command 

(3)  Message  precursor  command 

(4)  Message  command 

(5)  Abort  command 

(6)  BFN  readout  command 


2. 4. 2. 6  Distribute  Instructions  (Commands)  -  Level  3/Category  I.  After 

determination  of  command  type,  the  CD  routes  commands  to  the  appropriate 
internal  or  external  destination  for  execution  purposes. 


2. 4. 2. 6.1  Execute  Internal  Commands.  Command  types  that  are  executed 

internally  include  the  CD  configuration  command  and  the  abort  command.  CD 
configuration  commands  direct  which  of  the  redundant  command  decoders  is  to 
decode  subsequent  commands.  The  abort  command  is  provided  to  terminate  the 
message  mode  if  abnormal  operation  occurs.  This  command  is  provided  to 
prevent  a  message-mode  lockup. 


2. 4. 2. 6. 2  Output  Discrete  Commands.  Discrete  commands  are  routed  on 

dedicated  lines  to  other  subsystems  in  the  form  of  discrete  pulses  which  are 
used  to  activate  relays.  430  of  a  maximum  of  600  lines  are  used.  The  CD 
generates  a  discrete  pulse  from  the  decoded  command  message  and  sends  it  over 
a  dedicated  line  to  the  appropriate  address  contained  within  the  message 
through  interface  circuitry  capable  of  activating  a  relay  at  the  destination. 


2. 4. 2. 6. 3  Output  Message  Commands.  Message  precursor  commands  signal  the 

start  of  the  message  mode  and  contain  the  number  of  20-bit  messages  to  follow 
and  the  message  destination  (one  of  six  subsystems).  After  reception  of  the 
precursor  command,  18  of  the  20  bits  of  each  successive  message  command  is 
output  to  the  specific  subsystem  until  the  message  count  is  satisfied. 


2. 4. 2. 6. 4  Output  BFNR/0  Commands.  The  RFN  readout  command  (R/0)  is 
issued  to  read  out  the  BFR  command  register  after  its  receipt  of  a  message 
command. 
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2.5 


PROVIDE  TIMING 


2.5.1  Provide  Timing  for  Post  Launch  Events  -  Level  4/Category  I 

The  initiation  timer  triggers  programmed  post-launch  events, 
which  are  verified  by  telemetry.  These  events  are  solar  array  deployment, 
gimbaled  dish  antenna  deployment,  catalyst  bed  heater  warm-up  and  S-Rand 
telemetry  turn-on.  The  events  are  directed  by  the  ACE  which  is  enabled  by  the 
timer. 
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2.6 


PROVIDE  DIRECT  PAYLOAD  SERVICES 


In  addition  to  providing  the  proper  environment  for  the  payload, 
the  spacecraft  also  provides  a  few  direct  services.  However,  most  payload 
functions  are  carried  out  independently  of  the  service  functions. 


2.6.1  Provide  Payload  Antenna  Control 

The  payload  controller  send  command  requests  to  the  S/C  Control 
and  Monitoring  Function(see  2.4.2)  for  pointing  the  Gimbaled  Dish  Antenna 
(GDA)  and  reconf iguring  the  Multiple  Beam  Antenna  (MBA).  These  commands  are 
executed  by  the  Attitude  Control  Electronics. 


2. 6. 1.1  Reorient  GDA  -  Level  1/Category  III.  The  position  of  the  GDA  in 

azimuth  and  elevation  is  sensed  by  pots  on  the  GDA  and  verified  via  telemetry. 
The  ground  commands  azimuth  and  elevation  angles  and  the  ACE  generates  azimuth 
and  elevation  drive  signals.  The  GDA  stepper  motor  executes  the  ACE  commands 
with  open  loop  control  on  the  S/C.  The  loop  is  closed  via  telemetry  to  the 
ground. 


2. 6. 1.2  Reconfigure  MBA  -  Level  1/Category  III.  The  MBA  configuration 

is  determined  by  the  ground  via  telemetry.  The  ground  then  uses  this 
information  to  determine  any  needed  reconfiguration  commands.  The  ACS  directs 
commands  to  the  Payload  Beam  Forming  Network  (BFN) . 
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2.7 


PROVIDE  STATIONKEEPING* 


The  stationkeeping/naviqation  function  is  entirely  ground  based. 
The  di rect  purposes  of  the  function  are  to  provide  a  set  of  useful  services 
for  the  S/C  and  to  supply  users  with  ephemeris  information.  Although  the 
function  processes  hydrazine  data  (Resource  management),  it  does  not  directly 
or  automatical ly  have  control  over  the  actual  resource  management  function. 

It  has  no  part  in  maintaining  S/C  integrity  short  of  providing  the  "useful 
service".  The  function  does  not  directly  participate  in  sensing  activities. 
All  inputs  are  from  the  Ground  Systems  and  its  tracking  and  telemetry 
functions.  The  function  does  not  directly  act  to  fire  thrusters  or  command 
the  S/C.  It  outputs  sequences  of  commands  and/or  command  parameters  that  are 
supplied  to  the  Ground  System  in  a  manner  that  can  be  uplinked  to  the  S/C. 

The  current  stationkeeping  function  is  provided  by  the  ground  system  which 
provides  stationkeeping  for  a  large  number  of  other  spacecraft.  Figure  2-6 
shows  the  functional  hierarchy  of  the  stationkeeping  function. 


2.7.1  Provide  Tracking  Function 

The  S-Band  uplink  and  downlink  signals  between  the  S/C  and  the 
SCF  ground  stations  are  used  for  tracking  the  S/C. 

This  tracking  service  is  made  up  of  functional  elements  which 
include  1)  the  ground  generated  carrier  and  ranging  signal  transmitted  to  the 
spacecraft;  2)  the  spacecraft  TT&C  equipment  to  receive  and  detect  the  carrier 
and  ranging;  3)  the  spacecraft  equipment  to  re-transmit  the  detected  carrier 
and  ranqinq;  and  4)  the  ground  system  to  receive  the  signals,  process  the  data 
and  distribute  the  data  to  the  users.  The  data  is  used  to  find  out,  somewhat 
precisely,  where  the  spacecraft  is  located  and  its  motion  (i.e.,  its  orbit). 

The  tracking  function  is  made  up  of  ground  and  spaceborne 
functional  elements.  Tracking  the  spacecraft  requires  ground  interaction  with 
the  spacecraft.  Signals  have  to  be  transmitted  to  the  spacecraft  and  received 
from  the  spacecraft  to  be  able  to  do  precision  tracking.  Far  less  precise 
tracking  can  be  done  with  the  S-Band  downlink  only. 

The  current  autonomy  features  of  the  tracking  function,  which 
are  minimal,  are  the  same  as  those  discussed  under  the  telemetry  and  command 
service  function  sections(2.4.1  and  2.4.2).  It  is  obvious  that  tracking  with 
the  current  design  requires  active  ground  participation.  In  particular,  the 
ground  is  required  to  transmit  and  receive  the  tracking  signals.  Also,  active 
ground  participation  is  required  to  command  the  ranging  channel  on  and  off, 
and  to  command  tracking  in  the  coherent  or  noncoherent  mode. 


*By  S.  0.  Burks,  J.  B.  Jones,  E.  P.  Kan,  E.  Mettler  and  P.  R.  Turner 
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Figure  2-6.  Stationkeeping  Service  Functional  Hierarchy 


2. 7. 1.1  Ground  Segment  Tracking  Function.  The  SCF  ground  stations 
provide  the  tracking  functions  of  transmitting  to  the  S/C  a  stable  uplink 
S-8and  carrier  modulated  with  a  ranging  signal,  receiving  the  S/C  downlink 
S-Band  turned  around  carrier  with  ranging  modulation,  processing  the 
information  derived  from  a  comparison  of  the  uplink  and  downlink  signals,  and 
distributing  tracking  data  to  the  users  for  S/C  orbit  determination. 

The  tracking  function  typically  is  performed  simultaneously  with 
the  command  and  telemetry  functions.  Thus,  for  normal  tracking  those 
descriptions  associated  with  sending  commands  and  receiving  telemetry  at 
S-Rand  apply  here  (paragraphs  2. 4. 1.4.1  and  2. 4. 2. 3.1). 


2. 7. 1.2  Space  Segment  Tracking  Function-Level  2/Category  II.  The  S/C 
S-Band  portion  of  the  TT&C  subsystem  receives  the  carrier  and  ranging  signal, 
phase  locks  to  the  carrier,  demodulates  the  ranging  data,  modulates  the 
detected  ranqing  data  on  the  coherent  downlink  carrier,  and  transmits  the 
signal  at  S-Band  to  the  SCF  tracking  stations. 

Per  the  mentioned  similarity  to  the  command  function,  the  uplink 
signal  is  acquired  in  the  same  fashion  as  described  for  the  receive  command 
function  (paragraph  2. 4. 2. 4.1).  Commands  are  sent  to  activate  the  ranging 
channel  and  to  command  the  receiver  and  transmitter  into  the  two  way  coherent 
mode.  The  downlink  signal  is  established  in  the  same  manner  as  the  send 
telemetry  function  (paragraph  2. 4. 1.3.1). 

The  tracking  function  on  board  the  S/C  is  carried  out 
autonomously  once  the  transmit,  receive  and  range  functions  are  established 
from  the  ground.  Obviously,  the  S/C  needs  the  ground  based  signals  to  receive 
then  transmit  to  the  ground.  Thus,  two  way  tracking  by  definition  cannot  be 
divorced  from  the  ground. 


2.7.2  Oi rect/Control  Orbital  Position  of  the  Spacecraft 


2. 7. 2.1  Process  S/C  location  Sensing  Measurements  -  level  0/Category  I. 


2. 7. 2. 1.1  Schedule  Tracking.  The  stationkeeping  function  schedules 
tracking  and  data  acquisition  based  on  the  stationkeeping  strategy  selected 
and  on  station  availabil ity. 


2. 7. 2. 1.2  Request  Tracking  Data.  Tracking  data  is  requested  for  desired 
times,  the  desired  spacecraft  and  from  the  desired  station. 


2. 7. 2. 1.3  Process  Tracking  Telemetry  Oata.  Roth  tracking  and  telemetry 
data  are  received  from  the  tracking  stations.  Telemetry  measurements  for  fuel 
tank  temperature  and  pressure  are  separated  out  and  converted  to  engineering 
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units.  Tracking  data  for  the  selected  station  and  spacecraft  are  also 
separated  from  the  mass  of  trackinq  data. 


2. 7. 2. 1.4  Update  Navigation  Data  Rase.  The  data  base  for  naviqation 
software  is  updated  with  the  selected  telemetry  and  trackinq  data. 


2. 7. 2. 2  Determine  Spacecraft  Location  -  Level  O/Category  I. 


2. 7. 2. 2.1  Maintain  Navigation  Data  Base.  Data  editing  controls  and  model 
information  and  descriptions  are  maintained  in  the  Naviqation  Software  Data 
Base. 


2. 7. 2. 2. 2  Provide  Environmental  Models.  The  following  environmental 
models  are  developed  and  maintained  for  the  stationkeepinq  calculations: 
gravi tational ,  luni-solar  perturbations,  outqassing,  solar  pressure,  and 
maneuver  _W s  and  epochs. 


2. 7. 2. 2. 3  Determine  S/C  Location  at  an  Epoch.  The  state  of  the  S/C  at  an 
epoch  is  determined  by  a  batch  weighted,  least  squares  fit  to  the  trackinq 
data  measurements.  The  covariance  matrix  from  the  fit  is  a  measure  of 
accuracy.  The  State  of  Epoch  is  the  latest  estimate  of  the  orbit.  Other 
model  parameters  (^V's,  drag,  outqassing)  are  solved  for  as  desired. 


2. 7. 2. 2. 4  Update  Naviqation  Data  Base.  The  state  and  model  data  derived 
in  2. 7. 2. 2. 3  are  used  to  update  the  Navigation  Software  Data  Base. 


2. 7. 2. 3  Propogate  Ephemeris  -  Level  0/Category  I. 

2. 7. 2. 3.1  Determine  Position/Velocity  vs.  Time.  The  S/C  and  physical 

environment  are  modelled  to  integrate  the  equations  of  motion,  giving  position 
and  velocity  as  a  function  of  time. 


2. 7. 2. 3. 2  Calculate  Station  Limits  Violations.  These  are  calculated  over 
a  span  of  time  for  a  given  ephemeris.  North-South  violations  of  inclination 
and  East-West  longitude  violations  may  occur  when  the  S/C  position  exceeds 
predefined  hard  and/or  soft  bounds. 


2. 7. 2. 3. 3  Predict  Orbit  Related  Events.  The  following  orbit  related 

events  are  predicted: 


(1)  Tracking  station  antenna  pointing  parameters. 
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(2)  Sun  and/or  moon  interference  with  attitude  control 
earth  sensor. 

(3)  Eclipse  and  occupation  events  for  attitude 
controls. 

(4)  Orbital  State  vector  to  Payload  Users 

The  DSCS  payload  operations  personnel  require  the  satellite 
position  and  velocity  (i.e.,  its  state  vector)  for  communication  operations. 
The  orbital  state  vector  must  be  accurately  known.  For  DSCS  III,  the  range 
from  any  earth  station  to  the  satellite  must  be  known  within  9400  meters.  The 
range-rate  of  the  satellite  relative  to  any  earth  station  must  be  known  within 
0.19  meters/second  when  propagated  ahead  for  5  days. 


2. 7. 2. 3. 4  Supply  Event  Data  to  Other  Functions.  These  event  data  are 
provided  to  the  user,  the  ground  service  and  integrity  maintenance  functions. 


2. 7. 2. 4  Plan  Maneuvers  -  Level  0/Category  I. 


2. 7. 2. 4.1  Plan  to  Acquire  Station  or  Reposition.  The  following  steps  are 
iterated  until  the  S/C  is  in  the  requi  red  orM  tal  position: 

(1)  Update  the  navigation  data  base  with  station,  ephemeris, 
and  constraint  data. 

(2)  Compare  the  state/ephemeri s  with  the  desired  conditions  for 
this  phase  of  the  mission 

(3)  Compute  the  next  maneuver  in  this  sequence. 

(4)  Update  the  data  base  to  reflect  the  new  maneuver  for 
command  generation. 


2. 7. 2. 4. 2  Plan  North/South  Maneuvers.  North/South  (Inclination) 
stationkeepinq  maneuvers  are  planned  by  updating  the  data  base  with  the 
ephemeris  and  constraints  and  then  computing  the  N/S  stationkeeping  aV  and 
time.  This  is  used  to  update  the  data  base  for  command  generation. 


2. 7. 2. 4. 3  Plan  East/West  Maneuvers.  East/West  (Lonqitude)  stationkeeping 
maneuvers  are  planned  by  updating  the  data  base  ivith  the  ephemeris  and 
constraints  and  then  computing  the  E/W  stationkeeping  aV  and  time.  This  is 
used  to  update  the  data  base  for  command  generation. 


2. 7. 2. 5 


Generate  Maneuver  Commands  -  Level  0/Category  I. 


2. 7. 2. 5.1  Maintain  Propulsion  Model  Status.  The  propulsion  model  is 

updated  with  the  propellant  status  from  tank  temperature/pressure  telemetry. 
The  post-maneuver  center  of  gravity  location  is  calculated  and  checked  for 
constraint  violation.  Tank  valve  conf iguration  and  operability  status  is 
determined  and  maintained  in  the  model. 


2. 7. 2. 5. 2  Model  Propulsion  Performance.  The  propellant  required  for  the 
desired  aV  and  burn  time  is  calculated  and  the  tank  configuration  is  selected 
to  maintain  the  center  of  gravity  within  limits. 


2. 7. 2. 5. 3  Assemble  Total  Command  Sequence.  Propulsion  and  attitude 

control  configuration  commands  are  integrated  with  thruster  selection  and 
duration  commands  and  the  total  command  sequence  is  checked. 


2. 7. 2. 5. 4  Supply  Command  Sequence  to  Ground  System.  The  maneuver 
is  provided  to  the  Spacecraft  Control  and  Monitoring  Service  described  in 
Section  2.4.2. 


2. 7. 2. 6  Verify  Navigation  Performance  -  Level  0/Category  II.  After  a 
maneuver  is  accomplished  (see  2.7.4,  following)  the  performance  is  evaluated 
to  improve  the  performance  of  following  maneuvers. 


2. 7. 2. 6.1  Verify  Maneuver  Accuracy.  The  accuracy  of  both  North/South  and 
East/West  Maneuvers  is  verified  hy  the  same  procedure.  The  commanded  JiV  is 
compared  with  the  results  of  the  post  maneuver  orbit  determination  solution. 
This  is  used  to  check  thruster  performance.  Propellant  usage  and  center  of 
gravity  predicts  are  compared  with  the  propellant  state  derived  from 
telemetry.  The  navigation  software  data  base  is  updated  as  necessary  to 
improve  maneuver  performance. 


2. 7. 2. 6. 2  Assess  Ephemeris  Computation  Accuracy.  The  predicted  ephemeris 
from  the  pre-maneuver  orbit  determination  is  compared  with  that  from  the 
post-maneuver  orbit  determi nation.  Station  limits  behavior  is  compared  with 
that  predicted.  As  a  result  of  these  comparisons,  the  navigation  strategy  may 
be  modified  or  the  environmental  models  may  be  changed  to  improve  the 
ephemeris  accuracy. 


2. 7. 2. 6. 3  Assess  Current  Propellant  Status  Effect  on  Navigation  Strategy. 
This  provides  an  adaptive  capability  to  adjust  the  maneuver  strategy  based  on 
fuel  status.  Propulsion  efficiency  will  change  from  the  beginning  to  the  end 
of  S/C  life,  and  fuel  tank  failures  are  possible.  Such  changes  require 
modi fications  to  maneuver  strategy  such  as  deleting  North-South  maneuvers  or 
changing  the  timing  or  dead  bands  of  East-West  maneuvers. 


2.7.3 


Command  Maneuvers  (See  Section  2.4.2) 


2.7.4 


Maneuver  Spacecraft 


Less  than  24  maneuvers  per  year  are  to  be  required  (this  is  a 
ground  resources  constraint)  .  Four  types  of  maneuvers  are  performed:  1) 
adjustments  to  the  initial  orbit  inclination  and  orbit  eccentricities 
immediately  after  launch/injection,  2)  East-West  stationkeepinq  maneuvers,  3) 
North-South  stationkeeping  maneuvers,  and  4)  Station  Repositioning  maneuvers. 
The  strategy  is  similar  for  all  four.  Attitude  control  is  maintained  during 
all  maneuvers  with  the  following  tolerances: 

Initial  Orbit  Trim:  Pitch  +1.0° 

Roll  +1.0° 

Yaw  +2.0° 


Pitch  +0.1° 

Roll  +0.1° 

Yaw  jfl.O0 

The  frequency  of  in-plane  (East-West)  Stationkeeping  maneuvers 
is  a  function  of  both  the  nominal  station  longitude  and  the  allowable 
dead  band.  Using  the  most  optimistic  assumptions,  about  75%  of  the  longitudes 
will  require  an  East-West  Stationkeeping  maneuver  every  30  to  60  days,  for  a 
_+0.1°  dead  band.  This  is  illustrated  in  Figure  2-7,  which  plots  a  typical 
station  longitude  segment  vs.  the  frequency  of  maneuvers  for  several  dead  band 
values.  When  errors  in  the  orbit  determination,  maneuver  execution,  and  a 
complete  force  model  are  considered,  the  time  between  East-West  maneuvers 
could  decrease  to  10-15  days.  North-South  maneuvers  will  be  required  less 
often,  but  use  more  propellant. 


Stationkeeping 

Maneuver: 


2. 7. 4.1  Maneuver. 


2. 7. 4. 1.1  Select  Thrusters  -  Level  0/Category  I.  The  ground  selects 

North-South  or  East-West  thrusters  depending  on  the  type  of  maneuver. 
East-West  maneuvers  are  performed  by  the  attitude  control  pitch  or  yaw 
thrusters.  North-South  maneuvers  are  performed  by  dedicated  North  or  South 
thrusters.  Selection  of  redundant  thruster  pairs  is  also  made  for  resource 
management /integrity  maintenance. 


2. 7. 4.1.2  Select  Tanks  -  Level  0/Category  I  &  II.  The  ground  selects 
hydrazine  tanks  for  center  of  mass  (CM)  control  and  hydrazine  resource 
management. 


2. 7. 4. 1.3  Warm-up  Catalyst  Bed  -  Level  3/Category  I  &  II. 

Catalyst  Red  Heater  swit'ch-on  is  directed  by  the  ACS  or  by  ground  command. 
Telemetry  verifies  switch  closures  and  catalyst  bed  temperature. 


2. 7. 4. 1.4  Direct/Control  Maneuver  -  Level  2/Category  I.  The  qround 
transmits  attitude  control  parameters  and  the  computed  duration  to  the  ACS. 
The  ground  initiates  the  maneuver.  The  ACS  controls  attitude  with  the 
thrusters  and  terminates  _W  thrusting  after  the  preset  duration. 


2. 7. 4. 1.5  Fire  Thrusters  -  Level  3/Category  I.  Thrusters  fire  for  preset 
duration. 


2. 7. 4. 2  Maintain  Attitude  During  Maneuvers  -  Level  3/Category  I. 

Preferred  mode  of  attitude  during  maneuvers  is  AV  pulse-off.  Reaction  wheels 
may  also  be  used  for  East-West  maneuvers  in  which  the  thrust  from  the  selected 
pair  is  well  balanced.  In  addition,  both  reaction  wheels  and  pulse-off  may  be 
used  together. 


2. 7. 4. 2.1  Sense  Attitude.  The  Earth  sensor  senses  pitch  and  roll 
attitude.  The  sun  sensor  senses  yaw  attitude. 


2. 7. 4. 2. 2  Pi rect /Control  Attitude  Maintenance.  Pulse  Off  vs  Reaction 
Wheel  Mode  is  selected.  The  ground  commands  the  mode  and  reaction  wheel 
bias  for  pulse  off  mode.  The  ACS  logic  disables  the  reaction  wheels  and 
removes  the  pitch  momentum  bias.  The  ACS  provides  a  reaction  wheel  motor 
drive  signal  to  disable  the  wheels.  If  reaction  wheels  are  not  disabled  they 
continue  to  be  directed  to  spin  up/down  to  maintain  attitude.  The  ACS  selects 
outer  and/or  inner  control  loops.  For  the  pulse-off  mode,  the  outer  loop 
2-second  update  mode  is  selected  for  the  axis  which  will  be  controlled.  Inner 
or  outer  loops  are  selected  for  the  other  two  axes  by  the  ground.  In  the 
pulse-off  mode,  the  ACS  control  loop  directs  the  selected  thruster  of  a  pair 
to  stop  firing  for  short  times  so  that  attitude  control  is  maintained. 


2. 7. 4. 2. 3  Maintain  Attitude.  In  the  pulse-off  mode,  the  selected  thruster 
pulses  to  control  attitude.  In  the  reaction  wheel  mode,  the  reaction  wheel 
drive  motor  spins  wheels  up  or  down. 


SECTION  3 


MANAGE  RESOURCES 


Management  of  depletable  spacecraft  resources  is  conducted  both 
to  carry  out  the  service  functions  and  to  maintain  the  integrity  of  the 
spacecraft.  At  present,  two  types  of  resources  can  be  managed  by  the 
spacecraft:  power  resources  and  propulsion  resources.  Resource  management  is 
currently  a  ground  intensive  function. 

Another  type  of  resource  to  be  managed  on  the  spacecraft  is 
spares.  However,  since  the  substitution  of  functional  spare  elements  for 
di sfunctional  elements  is  the  basis  of  spacecraft  failure  recovery  (fault 
correction),  spares  management  functions  are  described  under  "Maintain 
Integrity",  Section  4.0.  When  the  spacecraft  becomes  more  autonomous 
computing  capacity,  data  movement  capacity,  data  storage  capacity,  etc,  will 
all  become  manageable  resources. 

Figure  3-1  shows  a  hierarchy  of  the  Resource  Management 

fun ctions. 
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MANAGE 

RESOURCES 


Figure  3-1.  Resource  Management  Functional  Hierarchy 


3.1  MANAGE  POWER* 


Three  types  of  power  resources  are  manaqed:  generated  power, 
stored  energy,  and  battery  life. 


3.1.1  Manage  Generated  Power 


3. 1.1.1  Manage  Solar  Array  (SA)  Attitude  -  Level  5/Category  I.  The  SA 

attitude  with  respect  to  the  sun  is  sensed  hy  the  sun  sensor  and  Solar  Array 
Drive  potentiometer  (SAD  pot).  The  ACS  directs  and  controls  SA  attitude, 
which  affects  SA  output.  This  is  an  autonomous  capability.  The  SA  drive 
adjusts  SA  angle. 


3. 1.1. 2  Solar  Array  Operating  Point  -  Level  0/Category  III.  There  is  a 

certain  operating  point  (V,  I)  that  maximizes  SA  output  power.  SA  output 
power  is  neither  sensed  nor  controlled  in  DSCS  III. 


3.1.2  Manage  Stored  Energy 


3. 1.2.1  Sense  On-Board  Parameters  -  Level  2/Category  I.  Numerous  SA, 

load,  and  battery  parameters  are  sensed  on  the  S/C  and  telemetered  to  the 
ground. 


3. 1.2. 2  Assess  State  -  Level  0/Category  I.  The  ground  segment  assesses 

net  energy  storage  for  a  complete  orbit  using  measured  and/or  projected 
profiles  of  SA  and  load  power.  If  it  becomes  necessary  for  energy  balance, 
the  ground  segment  directs  load  management. 


3. 1.2. 3  Execute  Relay  Commands  -  Level  2/Category  I.  Load  management  is 

implemented  by  the  execution  of  commands  to  open/close  power  distribution 
relays. 


3.1.3  Manage  Battery  Life  -  Category  I 


3. 1.3.1  Sense  Battery  Parameters  -  Level  1 .  The  voltage,  current,  and 

temperature  of  eacH  battery  (three  in  space  segment)  are  sensed  and 
telemetered  to  the  ground. 


*By  R.  C.  Detwiler,  T.  W.  Koerner  and  G.  W.  Wester 


3. 1.3. 2  Assess  Depletion  -  Level  0.  Using  the  recent  history  of  battery 

parameters,  the  ground  segment  determines  the  existing  battery  state  of 
charge.  With  this  information,  together  with  projected  profiles  of  SA  and 
load  power,  the  ground  segment  assesses  the  battery  depth  of  discharge  (DOD) 
for  the  next  orbit,  which  affects  battery  life.  If  it  is  necessary  to  keep 
DOD  <80%,  the  ground  segment  directs  load  management. 


3. 1.3. 3  Execute  Relay  Commands  -  Level  2.  Load  management  is 

implemented  by  the  execution  of  commands  to  open/close  power  distribution 
relays. 
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MANAGE  PROPULSION  RESOURCES* 


Three  types  of  propulsion  resources  are  managed:  Hydrazine 
propellant,  the  S/C  center  of  mass  (controlled  by  selecting  hydrazine 
depletion  strategy)  and  thruster  life. 


3.2.1 


Manage  Hydrazine 
Requirement:  10  year  Lifetine 

Allocation:  (first  DSCS  III  launch  carries  225  kg) 

Relocation  2.7  kg 

E-W  Adjust  10.2 

N-S  Adjust  139.4 

Initial  Acquisition 
and  Location  62.2 

Reacquisition  and 
Wheel  Unload  Not  Defined 

214.5  kg 


3. 2. 1.1 


Compute  Hydrazine  Mass  -  Level  2/Category  II. 


3. 2. 1.1.1  Sense  Tank  Temperature  and  Pressure.  Transducers  provide 

temperature  and  pressure  measurements  for  the  4  hydrazine  tanks  to  the 
telemetry. 


3. 2. 1.1. 2  Determine  Hydrazine  Mass.  The  ground  computes  the  mass  of 

the  remaining  hydrazine  from  the  temperature/pressure  telemetry. 


3. 2. 1.2 


Direct  Hydrazine  Management  -  Level  2/Category  II. 


3. 2. 1.2.1  Select  Thrusters.  The  ground  selects  thruster  banks  by  using 
the  reaction  wheel  unloading  impulse.  The  ACS  stores  this  thruster  selection 
until  it  is  changed  by  ground  command. 

3. 2. 1.2. 2  Select  Stationkeeping  Strategy.  When  the  depletion  of  the 
hydrazine  mass  is  determined  to  be  endangering  mission  lifetime,  N-S 
stationkeeping  is  reduced  to  conserve  hydrazine. 


By  R.  W.  Rowley 


3. 2. 1.3  Reduce  N-S  Stationkeeping  -  Level  0/Category  III.  For  the  first 

OSCS  III  launch,  discontinuation  of  N-S  stationkeeping  is  anticipated  after  7 
years,  to  preserve  attitude  control  and  E-W  stationkeeping  capabilities  for 
the  10  year  1i fetime. 


3.2.2  Manage  Center  of  Mass  (Requirement  =  +2. 5mm  along  yaw  axis) 

3. 2. 2.1  Determine  Center  of  Mass  Location  -  Level  1 /Category  I.  The 

ground  computes  center  of  mass  location  from  hydrazine-mass-remaining 
calculations.  Center  of  mass  location  knowledge  is  used  in  maneuver 
planning. 


3. 2. 2. 2  Select  Tanks  -  Level  2/Category  I.  The  ground  selects  tank 

and  latch  valve  configuration  for  attitude  control  and  maneuvers  so  that  the 
center  of  mass  will  be  maintained  within  the  requirement.  This  control  is 
required  for  maneuver  accuracy. 

3.2.3  Manaqe  Thruster  Life 

Thruster  Life  Requirements: 

(1)  Pulse  mode 

42,000  pulses  per  thruster 

(2)  Steady  state 

200,000  N-sec  per  thruster  (equivalent  to 
to  5 90  kg  hydrazine) 


3.2.3. 1  Manage  Thruster  Pulse  Life  -  Level  2/Category  II. 


3. 2. 3. 1.1  Sense  Accumulated  Pulses.  The  number  of  pulses  must  be  inferred 

from  available  telemetry  and  estimates  of  system  performance  during  pulse 
modes. 


3. 2. 3. 1.2  Manage  Thruster  Util ization.  The  ground  determines  if  thrusters 

can  meet  remaining  mission  life  without  exceeding  the  pulse  limits.  If  not, 
mission  sequences  and/or  thruster  selection  may  have  to  be  modified  to  reduce 
the  accumulated  pulses. 


3. 2. 3. 2  Manaqe  Thruster  Steady  State  Life  (Only  Affects  North-South 

rusters  on 


3. 2. 3. 2.1  Determine  Accumulated  Steady-State  Impulse.  The  ground 
determines  the  total  accumulated  thruster  on-time  and/or  propellant 
throughput. 


3. 2. 3. 2. 2  Manage  Thruster  Util ization.  The  ground  determines  if  thrusters 

can  meet  remaining  mission  lifetime  requirements.  If  not,  alternate  thrusters 
are  selected  or  the  sequence  is  modified  to  reduce  North-South 
stationkeeping . 


SECTION  4 


MAINTAIN  INTEGRITY  OF  DSCS  III  SYSTEM 


Inteqrity  maintenance  encompasses  both  routine  activities  which 
keep  the  spacecraft  operating  normally,  and  activities  which  correct  faults  or 
failures.  Inteqrity  maintenance  is  also  called  health  and  welfare 
maintenance.  Functions  which  protect  the  spacecraft  against  predictable 
events  which  would  impair  normal  operations  are  discussed  in  this  section. 

Inteqrity  maintenance  is  primarily  ground  directed.  In 
particular,  almost  all  unexpected  fault  correction  is  done  with  ground 
analysis  and  direction  using  information  contained  in  the  telemetry  stream. 

Functions  for  which  integrity  maintenance  is  discussed  are: 

(1)  The  spacecraft  as  a  whole. 

(2)  Power 

(3)  Attitude  Control 

(4)  Thermal  Control 

(5)  Spacecraft  Control  and  Monitoring 

(6)  Propulsion 

(7)  Stationkeeping 

Figure  4-1  displays  a  hierarchy  of  the  inteqrity  maintainance 
functions.  Each  function's  description  includes  its  own,  lower-level 
hierarchy. 
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Functional  Hierarchy 


4.1 


MAINTAIN  S/C  INTEGRITY* 

4.1.1  Acquire  S/C  Health  Information 

Each  function  in  the  S/C  provides  state  telemetry  from  which 
health  of  the  function  can  be  inferred.  A  telemetry  data  stream  containinq 
system  and  subsystem  health  status  information  is  generated  on  the  spacecraft 
by  the  TT&C  Master  Telemetry  Unit  (MTU)  and  transmitted  to  the  earth  via  a 
modulated  RF  carrier  as  part  of  the  Spacecraft  Control  and  Monitoring  Service 
described  in  2.4.1.  This  signal  is  received  by  a  Remote  Tracking  Station 
(RTS)  over  the  S-Band  telecommunications  channel.  The  telemetry  link  is  also 
received  over  the  SHF  (X-Band)  telemetry  link  by  the  EDM-SCCE  stations  and  by 
the  payload  user  terminal.  The  S-Band  link,  however,  is  the  primary  link  for 
health  and  maintenance  functions.  The  RTS  uses  an  analog  tape  recorder  to 
store  the  received  telemetry  signal  on  tape  for  subsequent  demodulation  and 
decryption.  The  stored  telemetry  signal  is  1)  read  from  tape,  2)  demodulated, 
3)  decrypted,  and  4)  routed  to  the  RTS  Univac  1230  computer. 


4.1.2  Analyze  Spacecraft  Health  Information 

The  telemetry  data  received  by  the  RTS  Univac  1230  computer  is 
decommutated  and  individually  selected  measurement  data  is  separated  from  the 
composite  telemetry  stream  for  processing.  Selected  measurements  are  limit 
checked  and  displayed  to  provide  definitive  information  on  spacecraft  health 
status.  The  STC  provides  telemetry  processing  requirements  in  the  form  of 
ground  telemetry  modes  prior  to  each  RTS  station  pass.  These  modes  are 
specified  in  the  form  of  pre-canned  telemetry  mode  software  and  are  used  to 
process  subsets  of  telemetry  data  where  each  is  associated  with  a  particular 
spacecraft  function  assessment.  The  RTS  sends  the  processed  telemetry  and 
alarm  violation  data  to  the  MCC  of  the  STC  where  it  is  stored,  displayed,  and 
analyzed  by  operations  personnel  under  the  direction  of  the  Mission 
Control ler. 


4.1.3  Generate  Redundancy  Management  Commands 

The  Mission  Controller  within  the  MCC  of  the  STC  coordinates 
ground  operations  which  require  the  definition  and  approval  of  command 
requests  required  for  spacecraft  redundancy  management.  MCC  operations 
personnel  request  necessary  command  operations  for  spacecraft  redundancy 
management.  The  command  requests  are  approved  by  the  Mission  Controller  for 
processing  by  MCC  operations  personnel.  Command  software  in  the  CDC  3800 
computer  is  used  for  processing  command  requests.  The  command  file  generated 
by  this  software  is  combined  with  antenna  pointing  data  and  input  to  a  Varian 
V-73  computer  for  formatting  with  telemetry  processing  directives. 


*By  W.  E.  Arens 
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4.1.4 


Process  Redundancy  Management  Commands 


Processing  commands  for  spacecraft  redundancy  management 
involves  1)  encryption,  2)  modulation  of  an  RF  carrier,  3)  transfer  to  the 
TT&C  subsystem  in  the  spacecraft  via  an  RF  link,  4)  demodulation,  5) 
decryption,  6)  decoding,  and  7)  distribution.  The  latter  four  functions  are 
accomplished  by  the  TT&C  subsystem  as  part  of  the  Spacecraft  Control  and 
Monitoring  Service  described  in  2.4.2.  The  actual  execution  of  a  command 
following  issuance  is  accomplished  by  appropriate  switching  and  control 
circuits  at  the  command  address  destination.  The  command  data  from  the  STC  is 
received  at  the  RTS  by  a  Univac  123(1  computer.  Spacecraft-unique  software 
within  the  Univac  1230  computer  at  the  RTS  is  used  to  generate  a  command  table 
from  the  received  command  data.  The  command  data  to  be  transmitted  is 
encrypted  and  used  to  modulate  an  RF  carrier  which  is  then  transmitted  to  the 
spacecraft  by  the  Operations  Controller  over  the  S-Band  or  SHF 
ground-to-spacecraft  telecommunications  link.  The  modulated  RF  carrier  is 
received  by  the  TT&C  RF  equipment  and  demodulated.  The  resultant  command  data 
is  decrypted  by  appropriate  decrypters  in  the  TT&C  RF  equipment  and 
subsequently  routed  to  the  TT&C  Command  Decoder  (CD).  The  TT&C  CD  determines 
the  command  type  and  address  to  which  a  command  is  to  be  issued.  It  then 
distributes  the  decoded  command  to  the  proper  internal  or  external  address 
resulting  in  the  switching  of  redundant  elements  in  the  designated  subsystem. 


4.2 


MAINTAIN  S/C  POWER  FUNCTION* 

The  spacecraft  power  function  is  maintained  by  providing 
isolation  and  protection  from  user  load  anomalies,  reconfiguring  the  power 
subsystem  by  switching  elements  and  conditioning  the  batteries  when  required. 
In  the  event  of  a  complete  battery  chain  failure  the  power  function  configures 
the  spacecraft  to  operate  on  solar  panels  only. 

Figure  4-2  shows  the  hierarchy  of  the  Maintain  Power  Function. 


4.2.1  Provide  Isolation/Protection  from  User  Load  Anomalies  - 

Category  I 


4. 2. 1.1  Isolate  Load  Faults  -  Level  3.  Spacecraft  load  fault  currents 

are  sensed  and  controlled  automatically  via  a  fuse  function  whose  inherent 
design  removes  the  faulted  load  from  the  primary  or  secondary  bus.  Fuse  sizes 
depend  on  individual  user  load  requirements. 


4. 2. 1.2  Protect  Power  Bus  from  User  Overloads  -  Level  1. 


4. 2. 1.2.1  Sense  Overcurrents.  Load  overcurrents  are  sensed  from  load 
current  monitors  in  the  North  and  South  Panel  distribution  bus  lines.  An 
overcurrent  condition  is  determined  by  ground  segment  analysis  of  the 
particular  power  profile. 


4. 2. 1.2. 2  Direct  Overcurrent  Protection.  The  spacecraft  is  directed  to 
remove  the  over-current  condition  after  ground  analysis  of  the  actual  in-orbit 
power  profile  vs  predicted  power  profile  has  determined  a  faulted  load. 
Alternatively,  the  degraded  load  condition  is  accepted  and  the  space  segment 
power  profile  is  adjusted  to  accommodate  the  overload. 


4. 2. 1.2. 3  Switch  Loads.  The  spacecraft  acts  by  switching  off  the  faulted 
load  in  the  particular  power  controller,  or  by  switching  other  loads  to 
provide  the  required  load  management  function. 


4.2.2  Provide  Power  Function  Protection  from  Internal  Faults  - 

Category  I 


4. 2. 2.1  Protect  Against  Battery  Chain  Failure  -  Level  2.  Battery  chain 

failures  are  presently  detected  through  a  review  of  telemetered  battery 
temperature,  voltaqe,  and  current  data.  Based  on  analysis  of  the  data  a 
failed  battery  is  removed  from  the  bus  by  turning  off  its  Battery  Charge 
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Regulator  (BCR).  Spacecraft  operations  with  one  or  two  failed  batteries 
requires  load  management  to  meet  the  80%  battery  Depth  of  Discharge  (DOD) 
requirement.  The  power  required  for  heaters  has  a  direct  hearing  on  load 
management  requirements  as  the  thermal  loads  can  cycle  on  at  any  time.  Peak 
load  demands  during  the  day  at  equinox  must  also  be  scheduled  such  that  the 
batteries  can  be  recharged.  Spacecraft  operations  on  one  battery  in  eclipse 
requires  almost  survival  mode  conditions,  due  to  the  uncertainties  in  thermal 
load  requirements  with  a  majority  of  the  subsystems  and  payload  turned  off. 
Operation  with  all  batteries  failed  requires  load  management  to  keep  peak  load 
demands  below  the  capability  of  the  solar  array  and  special  attitude  control 
functions  prior  to  spacecraft  power  down  during  eclipse. 


4. 2. 2. 1.1  Sense  Battery  Parameters.  Individual  battery  current,  voltage 
and  temperature  are  sensed  on  the  spacecraft: 


Normal  Battery  Characteristics 
Current:  Charge 


-  0  to  5  amperes,  10  amperes, 

maximum  peak  at  start  of  charge 
Discharge  -  0  to  29  amperes 

Voltage  -  18.4  to  23.1  VDC 

Temperature  -  0°C  to  20°C 


4. 2. 2. 1.2  Direct  Battery  Chain  Charge  Controls.  Spacecraft  battery  charge 
controls  are  directed  from  the "ground  segment,  to  determine  the  type  of 
battery  anomaly.  The  ground  may  modify  charging  conditions,  remove  the 
battery  from  bus  or  accept  degraded  battery/  battery  charge  regulator 
operation  by  revising  the  spacecraft  power  profile,  or  switch  off  the  battery 
charge  regulator  if  the  battery  has  failed. 


4. 2. 2. 1.3  Switch  Battery.  The  spacecraft  acts  by  switching  to  an 
alternate  voltage/temperature  curve  or  switching  off  the  battery  charge 
control  to  remove  the  battery  from  the  bus. 


4. 2. 2. 2  Protect  Against  Solar  Array  or  Shunt  Dissipator  Element  Failure 

-  Level  3.  Failure  of  a  single  element  reduces  source  power  'by 
less  than  3.3%  and  is  isolated*  from,  failure  propagation  automatically  by  the 
nature  of  the  circuit  design. 


4. 2. 2. 2.1  Detect  Failure.  Abnormal  solar  array  degradation  is  sensed 

through  ground  segment  analysis  of  energy  balance  and  battery  Depth  of 
Discharge  (DOD)  over  an  orbit.  Solar  array  power  capability  can  only  be 
measured  indirectly  when  no  power  is  being  shunted  and  the  thermal  load  power 
is  known,  so  a  3.3%  down  delta  in  output  power  may  not  be  instantly 
determi ned . 
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4. 2. 2. 2.2  Direct  Power  Management.  The  spacecraft  is  directed  from  the 
ground  segnent  into  power  management  of  the  load  profile  that  preserves  both 
energy  balance  and  the  DOD  criteria. 


4. 2. 2. 2. 3  Switch  Loads.  The  North  and  South  Power  Controllers  act  to 
recover  by  switching  spacecraft  loads  as  required. 


4. 2. 2. 3  Protect  Against  Secondary  Power  Converter  Failures  -  Level  2. 


4.2.2.3JI  Sense  Failure.  Abnormal  North/South  Power  Controller 
currents/and  or  user  load  malfunction  are  sensed  via  routine  checks  of 
spacecraft  telemetry  by  the  ground  segment.  Converter  over-current  or  failure 
condition  detection  is  dependent  on  the  particular  power  profile  in  operation 
on  the  space  segment. 


4. 2. 2. 3. 2  Isolate  Failure.  The  spacecraft  North  and  South  Power 
Controllers  are  di rected  from  the  ground  segment  through  a  converter  check 
routine  to  determine  that  a  converter  has  failed. 


4. 2. 2. 3. 3  Replace  Converter.  The  failed  converter  is  replaced  with 

the  redundant  converter  via  relay  switches  in  either  Power  Controller. 


4.2.2. 4  Protect  Against  Regulation  Electronics/Ouad  Relay  Failures  - 

Level  5.  These  functions  recover  from  single  point  failures 
automatically  via  inherent  design  features  within  each  of  the  circuits.  Any 
single  point  failure  will  be  corrected  without  space  or  ground  segment 
knowledge  of  the  event. 


4. 2. 2. 5  Compensate  for  Single  Load  Switch  Failures  -  Level  1. 


4. 2. 2. 5.1  Sense  Failure.  Abnormal  load  switch  operation  and  or  user  load 

malfunction  are  sensed  via  routine  checks  of  spacecraft  telemetry /operation  by 
the  ground  segment. 


4. 2. 2. 5. 2  Isolate  Failure.  The  spacecraft  load  switches  in  the 
North/South  Power  Controllers  are  directed  to  determine  relay  switch  failure 
by  ground  commands. 


4. 2. 2. 5. 3  Work  Around  Failure.  Ground  segment  operations  act  to  work 
around  relay  failures. 


4.2.3  Maintain  Rattery  Integrity 
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4. 2. 3.1 


Provide  Baseline  Energy  Storage  -  Level  1/Category  II. 


4. 2. 3. 1.1  Maintain  Baseline  Energy  Storage  Capacity.  Either  of  the 

following  is  sensed:  a)  battery  energy  storage  capacity  degradation  by 
ground  segment  analysis  of  battery  telemetry  voltage/current  data  and  length 
of  eclipse  or  b)  battery  power  draw  time. 

Battery  reconditioning  conditions: 

Eclipse  Period  -  72  minutes  maximum 

DC®  -  70%  (with  SCT  on) 

Voltage  -  below  19.0  VDC 

(all  other  conditions  normal) 

The  need  for  battery  reconditioning  is  determined  by  ground 
analysis  of  recent  battery  operation  (i.e.,  battery  parameter  degradation) 
prior  to  the  start  of  the  eclipse  season. 


4. 2. 3. 1.2  Direct  Conditioning.  The  battery  reconditioning  function  is 

directed  by  ground  segment  commands. 


4. 2. 3. 1.3  Recondition  Battery.  A  battery  is  reconditioned  by  switches  in 

the  PRli  that  turn  off  the  BCR  and  switch  on  the  battery  recondition  mode. 


4. 2. 3. 2  Provide  Battery  Operations  Integrity  -  Level  3/Category  I. 


4. 2. 3. 2.1  Control  Battery  Temperature.  Battery  temperature  is  sensed  to 
be  greater  than  32^0  by  spacecraft  sensor/ground  analysis.  The  battery 
charger  is  directed  to  stop  charging  automatically  and  battery  charging  is 
stopped  by  switching  functions  in  the  Power  Regulation  Unit. 


4. 2. 3. 2. 2  Control  Battery  Discharge  Time.  The  battery  discharge  time-out 
is  sensed  to  be  greater  than  80  minutes  by  the  spacecraft  timer.  The 
spacecraft  is  directed  to  remove  nonessential  loads  automatically  and  loads 
are  removed  by  switches  in  the  North/South  Power  Controllers. 


4. 2. 3. 2. 3  Control  Battery  Survival  Mode.  Loss  of  earth  lock  is  sensed  in 

the  Attitude  Control  Subsystem  of  the  S/t.  The  Power  Subsystem  is  directed  to 
automatical ly  remove  nonessential  loads  and  the  ACS.  These  loads  are  removed 
by  switches  in  the  North/South  Power  Controllers. 


4.2.4  Maintain  Power  Function  Integrity 
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4.2.4. 1  Protect  Against  Failed  Battery  Chain  -  Level  2/Cateqory  I. 

If  all  batteries  have  failed  the  S/C  must  depend  only  on  solar 
array  power  and  must  therefore  be  configured  to  go  through  solar  and  lunar 
eclipses  with  a  minimum  of  disruption  of  the  power  and  ACS  sources. 


4. 2. 4. 1.1  Sense  Battery  Chain  Failure.  The  power  function  senses  and  the 
ground  determines  that  ail  batteries  have  failed. 


4. 2. 4. 1.2  Direct  Eclipse  Compensation.  The  ground  prepares  the 
spacecraft  for  solar  and  lunar  eclipse  by  loading  command  sequences  shortly 
before  occurrence  of  the  eclipse. 


4. 2. 4. 1.3  Compensate  for  Eclipses.  The  solar  array  is  pointed  correctly 

to  maximize  power  upon  exit  from  the  eclipse.  In  addition,  power  loads  are 
shut  down,  the  reaction  wheels  are  manually  unloaded  and  the  thruster  logic  is 
disabled.  After  eclipse  exit  these  events  are  reversed,  i.e.,  loads  are 
switched  on  and  thruster  logic  is  enabled.  The  solar  array  position  is  set  to 
the  true  orbit  position  by  enabling  the  circularization  mode.  These  functions 
are  controlled  from  the  ACS. 


4. 2. 4. 2  Protect  Against  Solar  Array  Drive  Potentiometer  Failure  - 

Level  2/Category  H 


4. 2. 4. 2.1  Determine  SAP  Position.  The  ground  determines  from  the 
telemetered  SAD  pot  data  that  the  reading  is  different  from  the  expected  solar 
array  position. 


4. 2. 4. 2. 2 
SAD  pot. 


Switch  SAD  Pot.  The  ground  commands  a  switch  to  the  redundant 
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MAINTAIN  S/C  ATTITUDE  CONTROL* 

The  attitude  control  function  is  maintained  through  routine 
health  checks  and  maintenance,  reconfiguration  for  both  expected  and 
unexpected  external  events,  and  device  failure  detection  and  correction. 
Attitude  control  maintenance  is  accomplished  by  mode  selection  in  and 
reprogramming  of  the  ACS  electronics.  The  hierarchy  of  attitude  control 
maintenance  functions  is  shown  in  Figure  4-3. 


4.3.1  Perform  Routine  Health  Checks  and  Maintenance 


4. 3. 1.1  Perform  Data  Transfer  Handshakes  -  I/O  Ports  -  Level  4/ 

Category"  The  ~ACE-computer  is  described  in  Appendix  C.  The 
computer  performs-  checks  of  data  transferred  between  the  CPU  and  various  I/O 
ports  to  ensure  correct  transmission/reception.  These  handshakes  occur 
between: 


(1) 

CPU  - 

Reaction  Wheel  Port 

(2) 

CPU  - 

Thruster  Control  Port 

(3) 

CPU  - 

Solar  Array  Drive  Port 

(4) 

CPU  - 

BFN  port 

(5) 

CPU  - 

Gimbal  Dish  Antenna  Drive  Port 

(6) 

CPU  - 

Sensor  Signal  Port 

(7) 

CPU  - 

Telemetry  Port 

(8) 

CPU  - 

Command  Port 

(9) 

CPU  - 

Nuclear  Event  Detector 

4. 3. 1.2  Sense  Device  State  -  Level  2/Category  I.  Various  devices 

provide  telemetry  information  on  the  status  of  their  power,  temperature, 
switch  positions,  rates,  positive/negative  orientations,  redundant  component 
selection,  etc. 


Devices  providing  this  information  are: 

(1)  Earth  Sensor 

(2)  Sun  Sensors 

(3)  Rate  Gyro 

(4)  Reaction  Wheels 

(5)  Thrusters 

(6)  Solar  Array  Drives  and  Pots 

(7)  BFN  Port 

(8)  Gimbal  Dish  Antenna  Drives 

(9)  Sensor  Signal  Conditioning  Ports:  A/D  Converter  and  MUX 

(10)  Telemetry  Port 

(11)  Serial  Message  Port 
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(12)  Nuclear  Event  Detector 

(13)  Clock  and  Timing  Port 

(14)  ACE  Power  Supply 

(15)  Initiation  Timer 

(16)  Memo  ry 

The  information  is  used  by  the  ground  to  infer  the  health  status 
of  the  Attitude  control  function. 


4. 3. 1.3  Protect  Against  False  Command  -  Level  4/Category  I.  Discrete 

commands,  which  involve  no  change  in  critical  spacecraft  subsystems,  are 
automatically  enabled  and  executed.  No  extra  protection  is  implemented. 
Certain  discrete  commands,  involving  a  change  from  normal  modes  of  operation, 
require  an  "enable,  execute"  command  sequence.  A  special  "Enable"  command 
allows  for  "enabling"  a  collection  of  discrete  commands  before  a  "clear"  ends 

the  enabled  stream  of  commands:  (enable,  - ,  clear).  These  are  filtered 

through  the  command  decoder  for  the  sequence  check.  Special  message  commands 
are  processed  through  the  decoder  with  (1)  an  "enable"  of  nominal  stored 
commands  disable  (2)  an  "enable"  of  ground  command  dead  bands,  and  biases  and 
(3)  data  words  containing  the  ground  commanded  values. 

Other  message  commands  are  used  for  controlling  GDA  and  BFN 
components  as  well  as  setting  certain  modes  of  operation  in  the  ACE.  These 
commands  contain  "enables"  and  "executes." 

Four  "enable"  commands 

Enable  1:  Provides  enabling  of  the  commands: 

-  Reaction  wheel  P-Y(+)  OFF  and  EXECUTE 

-  All  N-S  thrusters,  heaters  and  ports  off  and  execute 

-  Auto  sun  bias  update  disable 

-  HRAM  #5  off  and  execute 

-  HRAM  #6  off  and  execute 

-  Failed  battery  mode  disable 

Enable  2:  Provides  enabling  of  the  commands: 

-  Reaction  wheel  P-Y(-)  off  and  execute 

-  Thruster  logic  disable 

-  Nominal  stored  commands  disable 

-  2  second  update 

-  Roll  positive  sun  sensor  B  to  roll  differentials  B 
select 

-  Lunar  Eclipse  mode  select 

-  HRAM  #7  off  and  execute 

-  HRAM  #8  off  and  execute 

-  Thruster  &  Cat.  Bed  Htr.  for  pitch  A/B  off 


-  Thruster  &  Cat.  Bed  Htr.  for  roll  A/B  off 

-  Thruster  &  Cat.  Bed  Htr.  for  yaw  A/B  off 

-  Auto  Sun  Stabi 1 ization  Enable 

Enable  3:  Provides  enabling  of  the  commands: 

-  Reaction  wheel  P-R(+)  off  and  execute 

-  SAD  A  power  on  for  backup 

-  SAD  A  power  off  and  execute 

-  Pitch  sun  sensor  control  selected 

-  HRAM  #1  off  and  execute 

-  HRAM  #2  off  and  execute 

-  Yaw  sensor  LSB  reset 

-  Thruster/CBH  Power  control  override  disable 
Enable  4:  Provides  enabling  of  the  commands: 

-  Reaction  wheel  P-R(-)  off/execute 

-  SAD  B  power  on  for  backup 

-  SAD  B  power  off  and  execute 

-  HRAM  #3  off  and  execute 

-  HRAM  #4  off  and  execute 

-  Roll  sun  sensor  control  select 

-  Yaw  sensor  select  MSB  reset 

Message  Commands: 

The  following  data  may  be  sent  after  the  commands  which  enable 
‘nominal  stored  command  disable'  (See  Enable  2)  and  allow  for 
the  enabling  of  'commanded  dead  bands  and  biases.' 

-  Pitch  bias 

-  Roll  bias 

-  Yaw  bias 

-  Pitch  thruster  dead  band 

-  Roll  thruster  dead  band 

-  Yaw  thruster  dead  band 

-  Pitch  thruster  rate  increment 

-  Roll  thruster  rate  increment 

-  Yaw  thruster  rate  increment 

-  Pitch  wheel  unload  start  time 

-  Pitch  wheel  unload  stop 

-  SAD  rate  adjust 

-  Pitch  thruster  pulse  width 

-  R/Y  axis  wheel  unload  start  time 

-  R/Y  axis  wheel  unload  stop  time 

-  Roll  thruster  pulse  width 

-  Yaw  thruster  pulse  width 

-  Pitch  connection  bias 

-  Yaw  gain  circularization 

-  Roll  solar  array  misalignment  bias 

-  Roll  dead  band  offset 

-  Pitch  dead  band  offset 
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-  Yaw  dead  band  offset 

-  Sun  sensor  processing  count  gain 

-  Sun  sensor  processing  level  gain 

-  Roll  update  of  yaw  gain 


4. 3. 1.4  Check  Parameter  States  vs  Predictions  -  level  4/Category  I. 


4. 3. 1.4.1  Attitude  Health  Check.  Pitch,  Roll  and  Yaw  (P,  R,  Y)  are  sensed 
to  be  outside  maximum  limits  of  0.25  deg  (P,  R)  and  2.5  deg  (Y)  during  nominal 
orbit  modes.  Attitude  control  is  recovered  by:  acquiring  the  sun,  acquiring 
the  earth,  selecting  for  yaw  control ,  selecting  for  normal  mode,  etc. 


4. 3. 1.4. 2  Solar  Array  Position  Check.  The  array  is  sensed  to  be  outside 

of  +2  deg  of  true  orbit  position.  The  ACS  can  switch  to  the  backup  POT's  and 
pitch  sun  sensor,  and  perhaps  the  backup  sensor  port.  The  solar  arrays  can  be 
slewed  if  necessary. 


4. 3. 1.4. 3  Yaw  Drift  Performance  Check.  The  yaw  drift  is  sensed  to  be 
greater  than  1.5*  over  last  deweighting  period.  The  values  for  sun  bias  and 
for  the  RACC  can  be  manually  set.  A  switch  to  the  pitch  sensor  is  possible 
for  yaw  control,  and  the  RACC  is  autonomously  disabled  if  the  anomaly 
continues. 


4. 3. 1.4. 4  Sun  Bias  Check.  If  the  sun  bias  value  is  sensed  to  be  not 

within  0.25°  of1  the  predicted  value  the  sun  bias  declination  angle  can  be 
updated  manually. 


4.3.2  Configure  ACS  for  External  Events 


4. 3. 2.1  Maintain  Attitude  During  Eclipse  -  Level  2/Category  I. 


4. 3. 2. 1.1  Compensate  for  Solar  Eclipse.  The  ground  navigation  function 
determines  the  parts  of  the  orbit  and  parts  of  the  day  (around  midnight,  no 
more  than  72  minutes)  when  the  solar  eclipse  will  occur.  No  special  action 
takes  place  because  the  eclipse  only  affects  the  sun  sensor  which  drives  the 
yaw  control  normally.  The  yaw  noon/midnight  controller  takes  control  around 
midnight  anyway. 


4. 3. 2. 1.2  Compensate  for  Lunar  Eclipse.  The  ground  function  determines 

when  a  lunar  eclipse  will  take  place.  IT”the  sun  intensity  is  predicted  to 
fall  below  40%  of  normal  intensity,  the  lunar  eclipse  mode  is  enabled.  If  the 
eclipse  is  to  fall  within  noon  or  midnight  +40  minutes,  this  mode  is  not 
enabled.  The  lunar  eclipse  mode  is  enabled,  by  the  ground,  shortly  before  the 
eclipse  occurs.  If  the  lunar  eclipse  mode  is  enabled  the  yaw  axis  cortroller 
deweights  the  yaw  control  signal  by  one-half.  RACC  is  applied  to  yaw  control 
signal.  The  auto  RACC  update  mode  is  bypassed. 
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4. 3. 2. 2 


Protect  Against  Loss  of  Earth  Presence  Signal  -  Level  3/ 
Category  I. 


4. 3. 2. 2.1  Sense  Loss  of  Earth  Presence.  The  earth  presence  sensor  shows 
no  response. 


4. 3. 2. 2. 2  Direct  S/C  Reconfiguration.  The  ACS  autonomously  directs  the 
S/C  to  a  survival  mode. 


4. 3. 2. 2. 3  Enter  Survival  Mode.  The  ACS  signals  the  power  subsystem  to 

turn  off  nonessentiaV  loads  including  the  X-Band  (SHF)  equipment  and  the  SCT. 
The  power  subsystem  disables  control  heaters  (but  survival  heaters  cannot  be 
disabled),  and  turns  on  the  S-Band  downlink.  The  ACS  turns  off  the  ACE  to 
safe  against  thruster  firings.  Loss  of  earth  presence  is  signalled  to  the 
ground,  which  determines  appropriate  action. 


4.3. 2. 3  Recover  from  a  Nuclear  Event  -  Level  5/Category  I. 

4. 3. 2. 3.1  Sense  Occurrence  of  Event.  Three  nuclear  event  detectors  detect 

radiation  presence  above  a  preset  threshold. 


4. 3. 2. 3. 2  Direct  Recovery.  The  ACS  computer  has  a  recovery  sequence  in 

ROM  which  reconfigures  the  ACS  control  logic  to  a  normal  operational  state. 


4. 3. 2. 3. 3  Recover  from  Event.  The  CPU  and  CPU-event  flags  are  reset.  The 

thruster  enable  is  reset.  The  HRAM  write  is  disabled  and  the  telemetry  is 
reset.  After  a  telemetry  sync  pulse  is  received  the  CPU  is  turned  back  on. 
The  CPU  then  executes  the  nuclear  safeing  software  which  clears  the  RAM  and 
CPU,  reloads  the  HRAM  parameters  into  the  RAM  and  resets  BFN  software  flags. 
The  use  of  earth  sensor  signals  is  inhibited  for  5  seconds  and  sun  sensor 
signals  for  300  seconds,  in  order  to  allow  transients  to  die  down. 


4. 3. 2. 4  Protect  Earth  Sensor  Against  Sun  -  Level  5/Category  I, 

4. 3. 2. 4.1  Sense  Sun  Intrusion.  Eight  sun  detectors  are  collocated  with  the 
eight  earth  presence  detectors.  These  automatical ly  detect  the  presence  of  the 
sun. 


4. 3. 2. 4. 2  Protect  Earth  Sensor.  The  earth  sensor  electronics  shut  off  the 

threatened  earth  sensor  as  well  as  the  sensor  on  the  opposite  side  of  the 
circular  array. 
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4. 3. 2. 4. 3  Resume  Sensor  Operation.  After  the  sun  has  left  the  sensor 
fields  of  view,  normal  earth  sensor  operation  resumes. 


4. 3. 2. 5  Yaw  Rate  Reduction  with  Gyro  Backup  -  Level  2/Category  I. 

The  ground  initiates  this  mode  for  post-launch  operations  and  as  required  for 
reacquisition  of  sun  and  earth,  or  as  a  backup  for  yaw  control  to  the 
sun/earth  sensors.  The  gyro  is  turned  on  by  the  ground,  to  be  used  for  yaw 
rate  control . 


4.3.3  Detect  and  Correct  Device  Failures 


4. 3. 3.1  Compensate  for  Reaction  Wheel  Failure-  Level  2/Category  I. 


4. 3. 3. 1.1  Determine  Failure  Mode.  Each  reaction  wheel's  (R/W)  tachometer 
reading  is  telemetered  to  the  ground.  If  the  absolute  value  of  the  rotation 
is  less  than  1 50  counts  the  reaction  wheel  and/or  the  tachometer  is  assumed  to 
be  faulty.  If  the  absolute  value  of  the  rotation  is  between  64  and  15D  counts 
possible  wheel  degradation  has  occurred.  If  the  tachometer  reading  is  zero 
the  tachometer  is  assumed  to  be  faulty.  If  the  wheel  is  considered  to  be 
degraded  but  not  failed,  surveillance  of  the  wheel  is  continued. 


4. 3. 3. 1.2  Direct  Failure  Recovery.  Failure  recovery  is  by  ground  command. 

The  first  step  is  to  switch  the  redundant  tachometer.  If  this  does  not  solve 
the  problem  the  autonomous  momentum  management  is  disabled  and  the  faulty 
wheel  is  switched  off.  To  maintain  attitude  control  the  opposite  wheel  is  set 
to  double  gain. 


4. 3. 3. 1.3  Recover  from  R/W  Failure.  The  faulty  wheel  is  switched  off  and 
the  opposite  wheel  performs  its  function. 


4. 3. 3. 2  Recover  from  Attitude  Control  Electronics  (ACE)  Failure  - 

level  2/Category  I. 


4. 3. 3. 2.1  Detect  Failure.  A  loss  of  attitude  and/or  ACE  telemetry 
indicates  an  ACE  failure.  The  ground  determines  the  type  of  failure  from 
trace  words  in  the  ACE  telemetry. 


4. 3. 3. 2. 2  Direct  Failure  Recovery.  The  ground  examines  the  trace  words  and 
commands  necessary  swapping  of  RAM's,  ROM's,  CPU's,  power  supplies,  A/D  and 
MUX  units. 


4. 3. 3. 2. 3  Recover  from  Failure.  Ground  command  swapping  continues  until 
failure  is  corrected. 
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4. 3. 3. 3 


Recover  from  Earth  Sensor  Failure  -  Level  2/Category  I. 


4. 3. 3. 3.1  Detect  Failure.  The  ground  investigates  attitude  telemetry.  An 
erroneous  pitch  and  roll  attitude  suggests  a  possible  earth  sensor  or  earth 
sensor  electronics  error. 


4. 3. 3. 3. 2  Recover  From  Failure.  The  ground  selects  switching  between 

redundant  earth  sensor  electronics.  When  one  specific  earth  sensor  (out  of 
eight)  is  determined  to  have  failed,  the  pair  of  detectors  containing  the 
failed  one  is  switched  off. 


4. 3. 3. 4  Recover  from  Sun  Sensor  Failure  -  Level  2/Category  I 


4. 3. 3. 4.1  Detect  Failure.  Erroneous  sun  sensor  (SS)  signals  and  yaw 

attitude  control  suggest  possible  pitch  SS  and/or  roll  SS  failures.  Redundant 
SS  readings  are  compared  to  determine  the  health  of  SS.  The  SS  with  the 
smaller  and  near-zero  reading  is  assumed  faulty. 


4i3.3.4.2  Recover  from  Failure.  The  ground  selects  switching  on  and  off 
redundant  sensors  and  amplifiers. 


4.3.4  Select  ACE  Modes  and  Modify  Programs 


4. 3. 4.1  RAM  Patch  of  ACE  Program  -  Level  2/Category  III.  A  tested 

program  patch  is  placed  in  the  redundant  RAM,  if  available.  The  RAM  patch 
enable  and  execute  flags  are  set.  When  a  breakpoint  is  encountered  in  the 
program,  a  'patch*  table  is  checked  for  a  patch  for  this  part  of  the  program. 
When  found,  the  patch  is  executed.  A  return  is  made  to  some  spot  in  the 
program  which  may  be  the  instruction  after  the  breakpoint. 


4. 3. 4. 1.1  Sense.  When  a  'fix'  has  been  found  and  tested  for  anomaly,  the 

patch  enable  and  execute  flags  are  sensed  at  breakpoints. 


4. 3. 4. 1.2  Pi rect/Control /Act .  The  program  executes  new  code. 

4. 3. 4. 2  Ground  Command  Override  Autonomous  Function  -  Level  3/ 
Category  III.  Autonomous  modes  and  override  procedures  are  defined  below. 
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4. 3. 4. 2.1  Autonomous  Sun  Acquisition  Disabled.  This  command  is  initiated 
in  two  cases:  ’  ~~ 


(1)  Normal:  Once  sun  acquisition  has  been  completed,  the  auto 
sun  acquisition  disable  command  and  auto  earth  acquisition 
enable  commands  allow  autonomous  auto  earth  acquisition  to 
proceed . 

(2)  Abnormal:  Either  the  auto  sun  acquisition  sequence  has 
failed  to  drive  the  solar  arrays  within  2  hours  of  the 
predicted  SA  position  or  the  SA  position  is  midnight  and  an 
eclipse  is  predicted.  In  either  case  a  sun  hold  mode  is 
disabled  unless  the  command  of  auto  sun  acquisition  disable 
is  given. 

Telemetry  tor  SA  position  is  sent  to  the  ground.  Auto  sun 
acquisition  is  disabled  via  ground  command.  In  the  normal  mode,  auto  earth 
acquisition  can  proceed  or,  in  the  abnormal  mode,  the  sun  hold  mode  is 
entered . 


4. 3. 4. 2. 2  Disable  Autonomous  Sun  Declination  Bias  Update.  The  absolute 
value  of  the  sun  bias  value  minus  the  predicted  sun  bias  is  sensed  to  be 
greater  than  .25  degree.  The  auto  sun  bias  mode  is  disabled  and  the  ground 
uplinks  new/old  sun  bias  values  and  reenables  the  autonomous  mode. 


4. 3. 4. 2. 3  Disable  Auto  RACC  Updates.  Yaw  drift  is  sensed  to  be  more  than 
1.5  degrees  and  the  following  conditions  are  present: 

(1)  Sun  bias  value  is  correct 

(2)  SA  position  is  correct 

(3)  Pitch  momentum  bias  is  correct. 

If  this  anomaly  occurs  twice  in  three  days  the  ground  disables 
the  auto  RACC  and  commands  RACC  values,  or  uses  Pitch  SS  to  determine  Yaw. 


4. 3. 4. 2. 4  Disable  Autonomous  Solar  Array  Position  Updates.  The  solar 
array  position  is  sensed  to  be  erroneous  when  compared  with  predicted 
position.  The  ground  disables  the  auto  solar  array  position  updates,  and 
checks  the  pitch  sun  sensor  for  anomalies.  If  an  anomaly  is  found,  the  ground 
commands  a  switch  to  the  backup  SADPOT  or  to  the  backup  Pitch  sun  sensor.  If 
needed,  the  ground  can  switch  to  the  backup  SAD  and  perform  a  slew  to  the 
correct  position. 


4. 3. 4. 2. 5  Unload  Reaction  Wheel  Manually.  If  one  of  the  three  tachometers 

has  a  count  above  1091,  the  ground  disables  the  thruster  logic,  selects  torque 
modes  for  the  thrusters  and  sets  for  thruster  fire.  The  ground  commands  a 
manual  wheel  unload  procedure. 


4. 3. 4. 2. 6  Disable  Auto  Dead  Band  Bias  Processing.  Anomalies  are  sensed  in 

autonomous  corrections  to  sensor  control  signals  during  stationkeeping 
maneuvers.  An  Auto  dead  band  bias  disable  command  is  sent  by  the  ground, 
which  causes  processing  for  an  autonomous  correction  of  sensor  control  signals 
to  be  bypassed  during  the  stationkeeping  mode. 


4. 3. 4. 3  Telemetry  "Axial"  Contingency  Modes  -  Level  2/Category  I. 

Ground  Commands  set  the  telemetry  processing  to  the  'Interrupt  Mode'.  This 
allows  for  additional  ACS  and  BFN  Data  to  be  transmitted  per  each  main  frame 
(2  CPU  cycles).  Processing  is  flagged  to  allow  'waits'  for  telemetry 
transmission.  When  the  special  telemetry  interrupt  mode  is  set,  252  bytes  is 
output  per  main  frame,  as  opposed  to  the  normal  output  of  107  formatted  into 
68  bytes  of  telemetry  data. 


4. 3. 4. 4  Sun  Sensor  Select  for  all  Axes  Sun  Control  -  Level  2/ 

Category  II.  One  of  a  redundant  pair  of  positive  pitch  sun  sensors  (North 
array)  and  one  of  a  redundant  pair  of  negative  pitch  sun  sensors  (South  array) 
are  selected  by  the  ground.  The  ground  selects  one  of  redundant  pair  of 
positive  roll  sun  sensors  (South  array).  With  the  positive  roll  sensor 
selected,  the  differential  amplifier  is  selected.  In  addition,  the  ground 
selects  one  of  redundant  pair  of  negative  roll  sun  sensors  (North  array).  The 
Pitch  sun  sensor  is  also  used  for  yaw  control  in  a  mode  where  the  sun 
declination  angle  >18.5  deg  and  where  time  is  outside  the  +2  hours  window 
about  noon  or  midnight.  The  differential  roll  sun  sensors  are  used  to  control 
yaw  (normal  mode).  Individual  roll  sun  sensors  are  used  to  control  roll  or 
yaw. 


93 


4.4 


MAINTAIN  THERMAL  CONTROL  FUNCTION*  -  LEVEL  2/CATEGORY  I 


The  heater  circuits,  with  the  exception  of  the  north  and  south 
shunt  panels  and  the  north  and  south  sun  sensor  assemblies,  are  redundant. 
(Although  Reference  states  that  all  heater  circuits  are  redundant.).  The 
redundancy  is  complete  and  includes  thermostats,  heaters,  and  power  lines  back 
to  the  electrical  power  bus.  The  normal  mode  of  operations  is  for  both 
heaters  of  a  redundant  pair  to  be  on. 

The  active  components  of  the  thermal  control  subsystem  can 
operate  autonomously  if  the  control  heaters  are  commanded  on.  With  the 
control  heaters  commanded  on,  the  spacecraft  and  its  components  can  be  kept 
within  allowable  operational  temperature  limits.  Further,  since  the  survival 
heaters  are  always  active,  the  temperature  of  the  components  of  the  DSCS  III 
will  remain  at  survival  temperature  levels  even  if  there  is  a  failure  of  both 
control  heater  circuits.  Thus,  with  the  control  heater  system  commanded  on, 
the  thermal  control  subsystem  will  operate  autonomously.  Further  analysis 
will  be  required  to  determine  lifetime  capability.  This  system  has  no  direct 
means  of  determining  failure  of  any  components,  and  this  knowledge  is  not 
necessary  for  operation  of  the  system  as  designed. 

Figure  4-4  is  a  hierarchy  of  the  Thermal  Control  Maintenance 

Function. 


4.4.1  Detect  Thermal  Control  Failures 

The  thermal  telemetry  data  used  to  monitor  the  temperature  of 
the  components  of  the  spacecraft  consists  of  149  thermistors.  The  location  of 
the  thermistors  is  shown  in  Table  7.2-3  of  Reference  2.  If  the  telemetry  data 
indicates  that  the  temperature  of  a  specific  component  is  out  of  limits,  the 
only  means  of  isolating  failures  is  by  trial  and  error. 


4.4.2  Direct  Recovery 


4. 4. 2.1  Direct  Recovery  From  Low-Side  Failures.  If  only  one  of  a 

redundant  pair  of  heaters  "is  on  and  the  temperature  is  too  low,  the  other 
heaters  can  be  commanded  on.  If  the  temperature  rises  the  first  heater  is 
assumed  to  have  failed.  If  not,  or  if  both  heaters  were  already  on  (normal 
mode),  both  heaters  are  assumed  to  have  failed.  The  survival  heaters,  which 
are  hard  wired,  will  automatically  maintain  the  component  at  the  survival 
temperature,  unless  they  also  fail. 


*By  R.  N.  Miyake  and  J.  A.  Plamondon 
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A 


Figure  4-4.  Thermal  Control  Integrity  Maintenance 
Functional  Hierarchy 
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4. 4. 2. 2  Direct  Recovery  From  High-Side  Failure.  The  heater  circuits, 

which  are  controlled  by  mechanical  thermostats,  have  both  a  control  thermostat 
and  an  over-temperature  thermostat,  the  electronic  thermostats  are  all  +T°C 
range,  thus  also  have  over-temperature  protection.  If  the  temperature  - 
telemetry  indicates  that  the  temperature  of  a  component  is  too  high,  one  or 
both  heaters  can  be  commanded  off,  or  one  heater  can  be  turned  off  and  the 
other  on. 


4.4.3 


Recover  from  Failure 

Heater  power  is  commanded  on  and  off  by  the  ground. 


4.5 


MAINTAIN  S/C  CONTROL  AND  MONITORING  FUNCTION* 


The  service  of  S/C  control  and  monitoring  is  "maintained"  by 
redundancy  management.  The  maintenance  of  these  functions  is  required  only  in 
the  event  of  a  failure.  A  failure  of  the  current  DSCS  III  S/C  design  control 
and  monitoring  function  to  perform  as  required  can  only  be  detected  by  ground 
based  operations.  (The  failure  of  the  ground  segment  to  perform  will  not  be 
addressed.)  If  there  is  a  failure  in  the  control  or  monitor  functions,  other 
than  ground  cockpit  error,  the  failure  can  be  corrected  by  selection  of  the 
various  "block"  redundant  elements  in  the  TT&C  S/C  subsystem.  To  correct  a 
failure  the  ground  segment  has  to  take  action.  This  action  typically  would  be 
to  send  a  direct  command  to  switch  to  a  redundant  element,  change  the 
frequency  of  the  uplink  or  downlink,  or  change  the  command  word  preamble. 


The 

basic  control  and 

following  functions  have  to  be  maintained  to  complete  the 
monitoring  service  functions  of  command  and  telemetry. 

(1) 

Telemetry  (information)  acquisition 

(2) 

Telemetry  generation 

(3) 

Telemetry  transmission 

(4) 

Command  reception 

(5) 

Command  processing 

(6) 

Command  (instruction)  distribution 

S/C  functions  will  be  addressed,  however,  the  methods  used  by 
the  ground  segment  to  maintain  these  functions  will  not  be  addressed  (e.g., 
how  the  ground  station  reliably  maintains  the  reception  of  telemetry  over  the 
X  or  S-B and  links).  The  ground  segment  is  addressed  only  in  terms  of  how  it 

influences  the  space  segment. 

There  is  currently  a  minimal  amount  of  autonomy  in  the  TT&C 
subsystem  for  maintenance  of  the  command  and  telemetry  functions.  Ground 
decisions,  intervention  and  commands  are  required  to  maintain  essentially  all 
of  the  TT&C  functions.  There  are  many  actions  taken  by  the  spacecraft 
automatically,  like  the  "AM  Sync"  function  of  activating  various  TT&C 
elements.  However,  these  automatic  features  are  for  providing  the  service, 
not  for  making  sure  that  service  is  available  in  the  event  of  a  failure  or 
anomaly. 


Figure  4-5  shows  the  Maintain  S/C  Control  and  Monitoring 
functional  hierarchy. 


*By  W.  E.  Arens  and  S.  0.  Burks 
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4.5.1 


Maintain  Telemetry  Function 


The  S/C  telemetry  function  service  is  provided  by  X-Band  and 
S-Band  communications  links  between  the  S/C  and  the  qround.  The  space  segment 
service  is  maintained  by  redundancy  management.  If  the  S/C  downlink  telemetry 
function  were  to  fail,  the  failure  would  be  detected  on  the  ground.  Ground 
decisions  would  be  made  to  correct  the  failure  by  commanding  the  switch  of 
block  redundant  elements,  or  receiving  a  different  downlink  telemetry  signal 
(in  normal  operation  the  same  information  is  being  transmitted  at  two  X-Band 
and  one  S-Band  frequencies).  The  S/C  cannot  autonomously  correct  a  telemetry 
function  problem.  Ground  segment  action  is  required. 


4. 5. 1.1  Maintain  Information  Acquisition  -  Level  2/Category  I.  The 

telemetry  information  acquisition  function  is  accomplished  by  the  TT&C 
subsystem  MTU  and  RTU  by  means  of  dedicated  input  lines  from  sensor  sources. 

In  the  current  DSCS  III  design,  information  acquisition  functional  integrity, 
in  the  presence  of  faults,  can  only  be  maintained  by  switching  redundant 
blocks  of  the  TT&C  MTU  and  RTU  via  ground  issued  commands. 

All  measurement  input  signals  are  applied  to  multiplexer  inputs. 
Analog  signals  are  applied  to  a  redundant  analog  multiplexer/ADC  block  in  the 
MTU.  These  analog  signals  include  analog  data  acquired  by  an  analog 
multiplexer  in  a  redundant  RTU  block.  Bi-level  and  serial -digital 
measurements  are  applied  to  a  redundant  bi-level/serial -digital  multiplexer 
block  in  the  MTU.  These  measurements  include  bi -level  data  acquired  by  a 
bi-level  multiplexer  in  a  redundant  RTU  block.  The  serial -digital 
measurements  require  enable  and  clock  signals  to  be  sent  by  the  MTU  to 
subsystem  sensor  sources  when  readout  of  a  serial -digital  measurement  is 
desired. 


A  fault  of  the  information  acquisition  function  likely  will 
result  in  the  loss  of  one  or  more  measurements  in  the  telemetry  data  stream. 
This  type  of  fault  can  only  be  detected  on  the  ground  by  personnel  analyzing 
processed  data.  If  the  fault  were  isolated  to  the  TT&C  information 
acquisition  hardware  (the  MTU  and  RTU)  a  command  would  have  to  be  transmitted 
to  switch  to  the  appropriate  redundant  unit. 


4. 5. 1.2  Maintain  Telemetry  Generation  -  Level  2/Category  I.  The 

telemetry  generation  function  is  accomplished  by  the  TY&C  MTU  and  RTU  using 
the  acquired  telemetry  information  from  2. 4. 1.1  under  control  of  the  MTU 
timing  and  control  block.  In  the  current  DSCS  III  design,  telemetry 
generation  functional  integrity,  in  the  presence  of  faults  can  only  be 
maintained  by  switching  redundant  blocks  of  the  Tl&C  MTU  and  RTU  via  ground 
issued  commands. 

An  analog  multiplexer  in  a  redundant  RTU  block  and  a  redundant 
analog  multi  pi exer/APC  block  in  the  MTU  are  provided  for  time  sampling  and 
digitizing  the  acquired  analog  measurements.  A  bi-level  multiplexer  in  a 
redundant  RTU  block  and  a  redundant  bi-level/serial-digital  multiplexer  block 
in  the  MTU  are  provided  for  time  sampling  the  acquired  digital  measurements. 


A  redundant  timing  and  control  block  in  the  MTU  is  used  to  control  the 
samplinq,  digitization,  and  formatting  functions  in  accordance  with 
information  stored  in  PROM. 

Typical  failure  modes  associated  with  the  telemetry  generation 
function  would  appear  as  improper  measurement  values,  timing,  sync  or  format 
in  the  output  telemetry  stream.  A  failure  would  be  detected  on  the  ground  and 
fault  isolation  to  the  redundant  block  level  accomplished  by  analysis  of  the 
status  of  other  telemetry  stream  data.  Following  fault  isolation,  a  command 
would  be  generated  and  issued  to  the  spacecraft  to  switch  to  the  selected 
redundant  block. 


4. 5. 1.3  Maintain  Telemetry  Transmission  -  Level  2/Category  II. 


4. 5. 1.3.1  Description.  The  S/C  has  two  basic  methods  of  maintaining 
telemetry.  One  method  is  multiple,  simultaneous  data  streams.  The  other  is 
switchable,  redundant  elements.  The  data  can  be  transmitted  over  the  S-Band 
system,  which  is  fully  redundant.  It  also  is  normally  transmitted 
simultaneously  over  the  S/C's  two  active  X-band  beacon  transmitting  paths. 
These  S/C  service  functions  are  "maintained"  by  ground  command  selection  of 
block  redundant  elements.  If  there  is  a  failure,  ground  detection  of  the 
failure  and  ground  action  is  required  to  correct  the  failure. 

a.  The  S-Band  function  has  the  following  redundant  elements: 

(1)  S-Band  transmitter  A  and  B.  A  is  prime,  B  is  redundant. 

(2)  S-Band  Encrypter  A  and  B.  A  is  prime,  both  can  be 
cross-strapped  to  the  transmitters.  The  MTU  1 s  drive  the 
encrypters  and  are  cross-strapped  in  the  MTU. 

MOTE:  The  redundant  S-Band  telemetry  hardware  is  in  passive 
standby. 

b.  The  X-Band  function  has  the  following  redundant  elements: 

(1)  Beacon  A  and  B  Transmitters.  (Both  normally  active) 

(2)  Frequency  Reference  Standard  redundant  pair  -  part  of  the 
communication  subsystems  (the  redundant  unit  is  in  passive 
standby) . 

(3)  PN  Generator:  A  or  B  (A  is  prime,  B  is  in  passive  standby. 
Outputs  are  cross-strapped  to  beacons). 

(4)  Encrypters  A  or  B  (A  is  prime,  B  is  in  passive  standby. 
Outputs  are  cross-strapped  to  data  mixer  and  Beacon 
modulator  inputs.)  The  MTU  outputs  are  cross-strapped  to 
the  encrypters.  Cross-strapping  is  in  the  MTU. 
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The  following  is  the  failure  detection  and  correction  process 
for  selecting  the  redundant  units. 

(1)  Detect  Telemetry  Failures 

Telemetry  failures  are  detected  on  the  ground.  The 
indications  would  be  no  telemetry,  no  RF  signal,  or  bad 
telemetry  data.  The  failure  could  also  be  indicated  in  the 
TT&C  telemetry  data. 


Corrective  Action  to  Restore  Telemetry 


The  analysis  of  the  information  will  likely  result  in  a 
ground  receiver  frequency  change  to  receive  one  of  the 
alternate,  simultaneous  data  streams. 


To  correct  the  failure,  ground  commands  can  be  issued  to 
select  redundant  hardware. 


Recovery 


The  recovery  from  a  failure  typically  will  be  by  the 
selection  of  a  redundant  unit.  Also,  either  one  of  the 
X-Band  or  the  one  S-Band  paths  could  be  used  temporarily 
for  telemetry.  These  paths  are  almost  functionally 
identical  and  can  be  used  interchangeably.  The  X  and 
S-Band  telemetry  functions  provide  alternate  paths  but 
normally  are  not  used  interchangeably. 


The  S/C  telemetry  transmission  service  ("Send  Telemetry"  in  the 
functional  hierarchy)  is  composed  of  two,  basic,  functional  areas.  These  are 
X-Band  (SHF)  and  an  S-Band  telemetry  system.  Both  of  these  systems  are  made 
up  of  block  redundant  hardware  with  cross-strapping  of  some  functional 
elements.  The  X  and  S-Band  telemetry  functions  on  the  spacecraft  are  almost 
functionally  identical.  Both  are  made  up  of  the  following  type  of  functional 
elements.  A  data  encrypter,  a  modulator,  a  transmitter,  the  microwave 
components  and  an  antenna(s).  Other  than  some  of  the  microwave  hardware, 
these  functional  elements  are  block  redundant  within  the  S-Band  and  the  X-Band 
(SHF)  telemetry  system. 

For  the  current  DSCS  III  design,  the  S-Band  is  used  for  general 
health  and  status  telemetry.  The  X-Band  telemetry  function  is  used  primarily 
for  operations  with  the  payload  and  as  a  backup  TT&C  link  for  the  S-Band 
telemetry.  Typically  the  S-Band  telemetry  is  planned  only  when  an  uplink 
command  signal  is  present.  However,  the  S-Band  telemetry  function  can  be 
commanded  to  be  independent  of  the  uplink.  The  X-Band  telemetry  function  is 
normally  on  and  can  be  used  as  a  backup  for  the  general  health  and  maintenance 
TT&C  functions  if  S-Band  telemetry  is  down  for  some  reason. 


The  X-Band  telemetry  link  normally  is  used  for  direct  payload 
(communications  subsystems)  operations  to  monitor  status  and  health.  Ti.e 
X-Band  has  the  same  data  available  as  the  S-Band  link.  Unlike  the  S-Band 
link,  the  X-Band  is  normally  always  on.  The  X-Band  downlink 
beacon  PN  sequences  and  carrier  provide  timing  information  to  the  users. 


4. 5. 1.3. 2  Current  Design  Autonomy.  The  current  DSCS  III  X  or  S-Band 
telemetry  function  can  only  be  activated  by  a  ground  command  signal  or  a 
couple  of  on-board  spacecraft  commands.  The  switching  of  redundant  elements 
can  only  be  done  by  ground  command.  The  X-Band  (SHF)  Beacon  Telemetry 
Transmitter  is  turned  on  and  off  by  ground  command  and  it  can  be  turned  off 
indirectly  by  the  loss  of  earth  presence  signal  or  by  the  80  minute  battery 
timer  signal.  The  S-Band  normal  "on"  mode  is  accomplished  by  acquiring  the 
uplink,  applying  command  modulation  and  sending  command  S-Band  data,  this 
uplink  command  signal,  when  received  by  the  S-Band  receive  function,  sends  an 
"AM  Sync"  signal  to  the  Command  Oecoder  (CD).  Indirectly  (via  the  South  power 
controller)  the  CD  turns  on  the  MTU  (if  off,  normally  on),  the  encrypters  and 
the  transmitter.  If  the  transmitter  and  encrypters  are  not  in  the  "AM  Sync" 
on  mode  they  can  be  turned  on  by  direct  command.  The  S-Band  transmitter  can 
be  turned  on  by  the  loss  of  earth  presence  or  by  the  battery  80  minute  timer. 
Also,  during  the  launch  phase,  the  S-Band  transmit  function  is  activated  by 
the  "initiation  timer". 

All  of  the  above  automatic  on/off  activities  are  for  providing 
the  telemetry  service.  There  are  jto  "automatic"  features  on-board  to  correct 
a  telemetry  failure. 


4. 5. 1.4  Maintain  Telemetry  Reception. 


4. 5. 1.5 


Maintain  Telemetry  Processing. 


>■  Ground  Functions 


4. 5. 1.6  Maintain  Telemetry  Distribution. 

4. 5. 1.7  Maintain  Telemetry  Analyses. 


4.5.2  Maintain  Command  Function 

The  maintenance  of  the  command  function  service  for  DSCS  III 
includes  ground  and  spaceborne  functional  elements.  The  ground  based 
operations  determine  the  commmands  which  need  to  be  sent,  acquire  the  command 
instructions,  generate  the  command  data,  and  transmit  the  command  data.  The 
spacecraft  receives  and  detects  this  transmitted  data,  processes  the  command 
data  (decodes),  and  issues  command  instructions  to  the  users. 
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The  command  transmission  (qround  segment)  and  command  reception 
(space  segment)  is  accomplished  over  two  functionally  identical  but 
independent  systems.  One  is  an  S-B and  system  used  for  qeneral  health, 
maintenance,  and  status  changes  on  the  S/C  from  the  Satellite  Control  Facility 
(SCF).  This  includes  health  and  maintenance  functions  of  the  payload.  For 
operations  with  the  payload  communications  subsystem,  the  X-band  link  is  used. 
These  X-Band  payload  commands  are  normally  transmitted  by  the  DSCS  III  ground 
system  (EDM-SCCE).  Both  links  will  perform  identical  command  functions  and 
each  serves  as  a  backup  to  the  other.  Once  the  links  are  established,  they 
pretty  much  perform  their  intended  function  without  ground  intervention. 

These  links  would  require  maintenance  only  in  the  event  of  a  failure.  A 
failure  on  the  uplink  which  is  due  to  the  S/C  hardware  can  be  corrected  only 
by  ground  action.  Essentially  there  are  four  possible  command  paths.  Any  one 
of  these  paths  can  be  used  to  command  the  S/C.  Once  a  command  path  is 
established,  redundant  units  can  be  selected  by  command  to  reestablish  the 
failed  function. 

4. 5. 2.1  Maintain  Command  Generation  -  Ground  Function.  (See  5.0) 

4. 5. 2. 2  Maintain  Command  Transmission  -  Ground  Function.  (See  5.0) 

4. 5. 2. 3  Maintain  Spacecraft  Command  Reception  -  Level  2/Category  II. 

4. 5. 2. 3.1  Description.  The  OSCS  Ill  S/C  has  two  basic  methods  of  providing 

the  S/C  command  reception  service.  Commands  can  be  received  over  the  S-Band 
link  or  over  the  X-Band  link.  Both  of  these  links  are  fully  redundant.  These 
command  reception  service  functions  basically  perform  as  required  without 
ground  intervention.  However,  the  maintenance  of  this  command  reception 
function  in  the  event  of  a  failure  can  only  be  accomplished  by  ground  based 
actions.  These  qround  actions  take  the  form  of  selecting  an  alternate  X  or 
S-Band  command  frequency  and/or  commanding  a  change  in  the  redundant  elements. 
Both  paths  have  a  receiving  antenna,  microwave  components,  a  receiver,  a 
command  detector,  a  decrypter,  and  an  output  to  the  redundant  command  decoders 
(CD). 

For  DSCS  III,  the  S-Band  command  function  is  used  to  receive 
general  spacecraft  control  and  maintenance  commands  from  the  SCF.  The  X-Band 
command  function  is  used  primarily  for  payload  (communications  subsystem) 
control  and  commands  typically  are  received  from  the  DSCS  III  EDM  SCCE  X-Band 
qround  stations.  These  command  systems  appear  to  be  used  at  relatively  random 
times  and  for  varying  time  durations.  However,  most  of  the  S  and  the  X-Band 
redundant  hardware  is  left  on  continuously  for  immediate  command  reception 
capability.  The  S-Band  redundant  hardware  is  in  active  standby  (i.e.,  is 
powered  on).  However,  the  decrypters  are  off  (turned  on  automatically  by 
"AM- Sync").  The  X-Band  hardware  has  some  redundant  elements  in  active  and 
others  in  passive  standby  (e.g.,  the  redundant  decrypter  is  off  and  can  only 
be  turned  on  by  ground  command). 


103 


For  the  S-Band  and  the  X-Band  system  there  are  basically 
redundant  A  and  8  command  reception  channels.  Channels  A  and  B  work  on 
different  frequencies.  Access  to  the  X  or  S-Band  command  channel  is  by 
selection  of  the  correct  A  or  B  channel  frequency  (the  A  channel  is  considered 
the  normal  channel  and  8  the  backup). 

The  S/C  S-Rand  Command  path  has  the  following  redundant 

elements: 

(1)  Receiver  (and  command  detector)  A  and  B.  A  is  prime  and,  B 
is  in  active  standby; 

(2)  Decrypter  A  and  B.  A  is  prime  and  B  is  in  active  standby 
(when  activated  by  AM  Sync).  The  receiver  outputs  and 
decrypter  inputs  are  cross-strapped  with  control  in  the 
command  decoder  (CD).  The  decrypter  outputs  are 
cross-strapped  in  the  CD. 

The  X-Band  Command  path  has  the  following  redundant  elements: 

(1)  Antennas  E1R,  E2R  and  MBA;  microwave  components,  and  low 
noise  amplifiers  which  are  in  the  communications  subsystem. 

(2)  SHF  to  S  down-converter  A  and  B.  A  is  prime,  R  is  in 
active  standby. 

(3)  S  to  IF  down-converter  A  and  B.  A  is  prime,  B  is  in 
active  standby.  Inputs  cross-strapped  passively  and 
actively  to  SHF-to-S  down  converter  output. 

(4)  Communications  Subsystem  Frequency  Reference  Standard. 
Redundant  unit  in  passive  standby. 

(5)  Decrypters  A  and  B.  A  is  prime  and  B  is  in  passive 
standby.  Decrypter  inputs  cross-strapped  by  active 
switching  to  S-IF  output.  Decrypter  outputs  cross-strapped 
to  Command  Decoder  (CD). 

The  following  is  the  failure  detection  and  correction  process 
for  selecting  the  redundant  units. 

(1)  Detect  Command  Failure 

A  failure  of  the  command  function  can  only  be  detected  by 
ground  personnel.  A  failure  in  the  hardware  could  result 
in  the  failure  of  the  S/C  to  execute  a  command  instruction. 
A  failure  could  be  indicated  in  the  downlink  TT&C 
telemetry.  The  S/C  design  cannot  recognize  a  failure  of 
this  function. 
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(2)  Take  Corrective  Action  to  Restore  Command 


The  ground  operations  will  have  to  evaluate  the  failure 
information  available  and  execute  the  process  of  selectinq 
an  alternate  command  path.  In  normal  operations  both 
S-Band  command  channels  are  active.  If  one  path  fails  the 
other  can  be  selected  by  changinq  the  ground  transmitter 
frequency.  Some  cross-strappinq  functions  and  the 
operating  command  decoder  can  be  selected  by  the  command 
word  preamble. 

The  X-Band  command  channels  are  selected  in  a  manner 
similar  to  the  S-Band.  The  key  difference  being  that  some 
of  the  X-Band  command  hardware  elements  are  in  passive 
standby  and  have  to  be  ground  commanded  "on".  This  would 
have  to  be  done  through  the  S-Band  command  channels. 

There  essentially  are  four  actively  available  command 
channels,  two  at  X-Band  (at  different  frequencies)  and  two 
at  S-Band  (at  different  frequencies).  However,  because  of 
its  implementation,  the  X-Band  path  can  be  wiped  out  by  one 
failure  (e.g.,  the  frequency  reference  or  the  decrypter). 
The  cross-strapped  paths  can  be  selected  by  ground  commands 
once  one  of  the  four  available  paths  is  made  operational  by 
ground  operations  selection  of  the  path. 

(3)  Recover 

The  recovery  from  failure  could  be  accomplished  on  either 
the  X  or  the  S-Band  command  channel  once  the  alternate 
channel  frequency  is  selected  and  transmitted  from  the 
ground. 


4. 5. 2. 3. 2  Current  Design  Autonomy.  The  maintenance  of  the  command 

reception  on  S  or  X-Band  currently  requires  a  ground  decision.  If  either 
channel  A,  (X  or  S)  is  selected  and  will  not  process  commands,  qround 
operations  first  approach  might  be  to  change  the  ground  transmitter  frequency 
to  the  B  channel  and  attempt  commands  over  that  channel.  This  is 
pseudo-autonomous  in  that  a  ground  decision  is  required  to  determine  that  the 
first  command  channel  did  not  work  and  then  to  change  the  uplink  transmitter 
frequency  to  select  an  alternate  command  channel. 

Both  S  and  X  Band  command  paths  use  frequency  diversity  to 
select  the  receiver  path.  Decoders  are  selected  by  a  command  preamble  word. 
Decrypters  are  selected  by  having  a  ground  command  link. 

The  redundant  X-Band  link  requires  direct  commanding  of  some 
redundant  elements  because  some  of  these  redundant  units  are  normally  off  in 
passive  standby  and  are  activated  only  by  ground  command  (e.g.,  the  decrypter 
and  Comm  subsystem  frequency  standard).  Thus,  the  X-Band  redundant  paths 
have  single  point  failure  modes  which  are  backed  up  by  the  fully  redundant 
S-Band  paths. 


4. 5. 2. 4  Maintain  Command  Processing  -  Level  2/Category  I.  The  command 

processing  functions  of  prioritization,  validation,  and  determination  of  type 
are  accomplished  by  the  TT&C  CO  following  receipt  of  commands  from  either  the 
TT&C  S-Band  or  SHF  RF  equipment.  In  the  current  DSCS  III  design,  command 
processing  functional  integrity,  in  the  presence  of  faults,  can  only  be 
maintained  by  switching  the  roles  of  redundant  command  decoders  via  ground 
issued  commands.  Each  of  the  redundant  command  decoders  has  its  own  internal 
power  converter.  Appropriate  logic  for  the  backup  command  decoder  is 
adequately  powered  from  its  own  power  converter  so  that  it  can  respond  to 
commands  from  the  ground  to  switch  the  prime  and  secondary  roles  of  the  two 
command  decoders. 

There  are  basically  two  faults  associated  with  on-board  command 
processing  that  can  occur.  These  are:  1)  failure  to  issue  the  requested 
command  or  2)  issuance  of  an  incorrect  command  to  a  designated  spacecraft 
subsystem  recipient.  Failure  to  respond  or  incorrect  response  to  an  issued 
command  is  detected  on  the  ground  by  monitoring  the  telemetry  output  stream 
from  the  TT&C  subsystem.  By  analyzing  the  fault  occurrence  in  terms  of  the 
integrity  of  all  elements  in  the  command  loop,  if  a  failure  in  the  CD  command 
processing  function  were  isolated  to  the  TT&C  CD,  the  ground  would  generate  a 
command  and  issue  it,  through  the  backup  uplink,  to  the  backup  command  decoder 
to  make  it  prime. 


4 . 5 . 2 . 5  Maintain  Instruction  (Command)  Distribution  -  Level  2/Category 

J_.  The  command  distribution  function  of  routing  commands  to  the  appropriate 
Tnternal  or  external  destinations  for  execution  is  accomplished  by  the  TT&C  CD 
in  the  same  manner  as  the  command  processing  function  in  4. 5. 2. 4. 

The  primary  failure  mode  associated  with  the  on-board  command 
distribution  function  is  failure  to  issue  a  requested  command  to  the 
designated  spacecraft  subsystem  recipient.  Detection  of  such  a  fault  on  the 
ground,  if  isolated  to  the  CD,  would  result  in  the  same  actions  as  outlined  in 
4. 5. 2. 4. 
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4.6 


MAINTAIN  S/C  PROPULSION  FUNCTION* 

The  spacecraft  propulsion  function  is  maintained  by  maintaining 
the  thrusters  and  the  propellant  system  tanks  and  valves.  Figure  4-6  shows 
the  hierarchy  of  the  propulsion  maintenance  function. 


4.6.1  Maintain  Thruster  Health  -  Level  2/Category  I 


4. 6. 1.1  Detect  Failure.  The  ground  analyzes  propulsion  telemetry  to 

detect  failures^  Catalyst  bed  temperature  is  used  to  detect  heater  failures. 
The  number  of  pulses  required  to  produce  a  given  V  or  momentum  change  is 
monitored  to  determine  thruster  pulse  performance.  The  delivered  aV  is 
monitored  to  determine  steady-state  performance  of  the  thruster.  The 
spacecraft  rates  and  catalyst  bed  temperature  are  monitored  to  detect  a 
thruster  valve  failed  open/closed  or  leaking.  Determination  of  thruster 
faults  in  general  requires  the  analysis  of  performance  over  time  (trend 
analysis) . 


4. 6. 1.2  Direct  Recovery.  The  ground  determines  latch  valve 

configurations  to  isolate  the  branch  with  the  offending  thruster. 


4. 6. 1.3  Recover  from  Failure.  If  required,  the  latch  valves  are 

reconfigured  to  switch  out  the  faulty  thruster  branch. 


4.6.2  Maintain  Propellant  System  Health  -  Level  2/Category  I 

Pressurant  loss  from  leakage  is  required  to  be  less  than  10%  in 

10  years. 

4. 6. 2.1  Detect  Failure.  The  ground  monitors  tank  pressure  and 

temperature  telemetry  and  thruster  activity  to  detect  unexplained  propellant 
or  pressurant  loss.  Schematic  and  plumbing  diagrams  are  analyzed  to  determine 
the  location  of  the  leak. 


4. 6. 2. 1.1  Monitor  Propellant  Valve  Position.  Anomalous  use  of  propellant 

is  sensed  from  telemetry.  Also  valve  positions  are  checked  during  orbit 
injection  and  launch  and  are  checked  as  a  part  of  center  of  mass  (cm)  control. 
Opening/closing  of  valves  is  commanded  by  the  ground  to  reconfigure  propellant 
usage  or  to  correct  cm  control. 


*By  R.  W.  Rowley 
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Figure  4-6.  Propulsion  Integrity  Maintenance  Functional  Hierarchy 


4. 6. 2. 1.2  Monitor  Propellant  Tank  Pressure.  As  a  health  check  before 
control  maneuvers  or  as  a  result  o f  anomalies  in  predicted  vs.  present  state 
of  propulsion  subsystem,  the  tank  pressure  readings  from  telemetry  are 
analyzed.  If  the  pressure  in  a  tank  drops  below  95  psi  or  rises  above  350 
psi,  contingency  operations  are  planned. 

The  ground  assesses  the  anomaly  as  caused  by:  propellant  leak, 
faulty  pressure  transducer,  or  thruster  leak.  The  ground  also  checks  for 
possible  propellant  decomposition.  The  ground  reconfigures  for  fault 
isolation  and  center  of  mass  maintenance  by  directing  shutting  of  latch  valves 
and  disabling  of  thrusters. 


4. 6. 2. 2  Recover  from  Failure.  The  latch  valves  are  directed  by  the 

ground  to  be  configured  to  isolate  the  failed  propellant  tank.  Mission 
replanning  may  be  required  to  accommodate  the  lost  propellant. 


4.7 


MAINTAIN  STATIONKEEPING  FUNCTION* 


The  stationkeepinq  is  currently  a  qround  function,  except  for 
the  spacecraft  portion  of  the  tracking  function.  Therefore  only  maintenance 
of  the  trackinq  function  is  discussed  in  this  section.  Figure  4-7  shows  a 
functional  hierarchy  of  stationkeepinq  maintenance.  A  space  (4.7.2)  is  left 
for  maintenance  of  the  remainder  of  the  stationkeepinq  functions,  because  this 
will  become  necessary  when  on-board  stationkeepinq  is  included  (See  Volume 
III,  Section  4.7).  Section  5  discusses  maintenance  of  the  ground 
stationkeepinq  functions. 


4.7.1  Maintain  Trackinq  Function  -  Level  2/Cateqory  II 


4. 7. 1.1  Description.  The  trackinq  function  is  accomplished  over  the 

uplink  and  downlink  S-Band  communication  paths.  This  two-way  coherent 
trackinq  service  requires  the  S/C  receiver  and  transmitter  functions. 

Trackinq  function  maintenance  is  only  required  in  the  event  of  a  failure.  The 
correction  of  the  failure  usually  will  be  by  the  selection  of  receive  or 
transmit  path  redundant  components. 

The  tracking  service  in  the  functional  hierarchy  basically 
provides  the  means  for  spacecraft  orbit  determination  through  the  use  of  the 
S-Band  RF  uplink  and  downlink  signals.  The  hierarchy  provides  for  the 
maintenance  of  this  service.  Maintenance  is  a  redundancy  management  function 
directly  associated  with  the  maintenance  of  the  uplink  and  downlink  signals 
(i.e.,  "Maintain  Telemetry  Function"  and  "Maintain  Command  Function"  described 
in  Section  4.5). 

The  "maintenance"  of  ground  functions  toward  automating  qround 
functions  will  not  be  addressed  herein,  only  the  spacecraft  elements.  The 
spacecraft  functional  areas  applicable  to  the  trackinq  function  are  "Receive 
Ground  Signals,"  "Detect  Ground  Signals"  and  "Transmit  Trackinq  Signals."  The 
maintenance  of  these  three  functions  is  basically  the  selection  of  block 
redundant  elements  in  the  event  of  a  failure. 


4. 7. 1.2  Current  Design  Autonomy.  The  current  autonomy  features  of  the 

trackinq  function,  which  are  minimal,  are  the  same  as  those  discussed  under 
the  command  and  telemetry  sections.  Also,  active  ground  participation  is 
required  to  command  the  ranging  channel  on  and  off  and  to  command  trackinq  in 
the  coherent  or  noncoherent  mode.  The  latter  two  commands  are  associated 
with  the  tracking  function. 


*By  S.  0.  Burks 
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(SEE  5) 


Figure  4-7.  Stationkeeping  Integrity  Maintenance 
Functional  Hierarchy 
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The  S-Band  redundant  elements  involved  are: 


(1)  Receiver  A  and  B 

(2)  Transmitter  A  and  B. 


The 

for  selecting  the 


following  is  the  failure  detection  and  correction  process 
redundant  units. 


(1)  Detect  Tracking  Failure 

Failures  can  only  he  detected  on  the  ground.  The  failures 
could  be  in  the  receiver,  the  transmitter,  or  the 
connecting  elements  between  the  receiver  and  transmitter. 
Failures  would  be  indicated  by  the  inability  of  the  ground 
to  process  two-way  coherent  tracking  data. 

(2)  Corrective  Action  to  Restore  Tracking 


Ground  commands  can  be  issued  to  select  the  alternate 
transmitter.  Also,  the  ground  transmitter  frequency  can  be 
changed  to  select  the  alternate  receiver.  For  two-way 
coherent  ranging,  the  A  receive/transmitter  pair  or  the  B 
receiver/transmitter  pair  must  be  chosen. 

(3)  Recovery 

Recovery  is  achieved  after  the  above  ground  actions  have 
established  a  functioning  receiver/transmitter  pair  and 
two-way  coherent  tracking  data  is  observed  at  the  ground 
station. 
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SECTION  5 


CURRENT  OSCS  III  GROUND  SYSTEM* 


This  section  describes  and  summarizes  the  functions  now 
performed  by  the  DSCS  III  ground  system.  Volume  III,  Section  5  describes  the 
ground  impacts  of,  and  issues  in  adding  autonomy  to  the  spacecraft. 

The  DSCS  satellite  payload  is  controlled  primarily  by  the 
Defense  Communications  Agency  through  its  control  center  and  associated 
tracking  stations.  (See  Section  1)  The  spacecraft  primary  operational 
monitoring  and  control  is  from  the  Air  Force  Satellite  Control  Facility 
(AFSCF)  and  its  associated  tracking  stations  as  described  in  Section  2.4. 
Their  interfaces  are  depicted  in  Figure  5-1. 


5.1  DSCS  III  SPACECRAFT  CONTROL  SYSTEM 

The  DSCS  III  spacecraft  is  controlled  and  monitored  as  described 
in  Section  2.4  by  operations  personnel  at  the  AFSCF.  The  ground  portion  of 
this  control  and  monitoring  function  is  described  herein  as  DSCS  III  Mission 
Control  (MC).  Figure  5-2  is  a  functional  flow  diagram  of  the  DSCS  III  MC  and 
Figure  5-3  is  a  hierarchical,  functional  description  of  the  DSCS  III  MC.  The 
current  functions  of  the  DSCS  III  MC  are  described  in  the  following 
paragraphs. 


5.1.1  Service  Functions 

As  shown  in  Figure  5-4  the  ground  performs  all  the  information 
collection  and  analysis  not  performed  autonomously  on  the  spacecraft. 

Activity  planning  is  done  using  this  information.  These  activities  are 
described  as  a  part  of  the  spacecraft  functional  description  in  Sections  2,  3 
and  4.  During  real  time  operations  the  ground  performs  these  services  as  well 
as  managing  the  ground  resources  necessary  to  perform  them,  as  described  in 
Figure  5-4. 


5.1.2  Resource  Management  Functions 

Management  of  ground  resources  is  done  by  scheduling  activity  of 
ground  supporting  systems  and  personnel.  This  aspect  of  DSCS  III  Mission 
Control  is  not  addressed  in  detail  in  this  report.  Much  of  the  information 
that  would  fill  in  this  portion  of  the  hierarchy  outline,  as  structured  here, 
is  not  readily  available,  and  much  of  it  may  not  be  directly  pertinent  to  the 
Autonomy  study.  Many  considerations  in  resource  management,  e.g., 
time-sharing  of  computers,  number  of  spacecraft  being  supported,  number  of 
personnel  (teams,  shifts,  redundancy,  etc.),  and  time-criticality  of  functions 
are  out-of-scope  for  this  assessment. 


*By  B.  L.  Sharpe 
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X-BAND  TELEMETRY  AND  COMMAND  TELEME^^^Nd'tRACKING 


5-1.  DSCS  III  Mission  Control  External  Functions  and  Interfaces 


COMMUNICATE 
WITH  SATELLITE 


Control  Functional  Flow  Internal  Functions  and  Interfaces 


DSCS  III  MISSION  CONTROL  (MC  ) 


ssion  Control  Functional  Hierarchy  -  Overview 


Figure  5-4. 


Mission  Control  Functional  Hierarchy  - 
Useful  Services 
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5.1.3 


Maintenance  of  Integrity 


The  functional  description  is  in  Figure  5-5.  Maintaining  the 
integrity  of  the  ground  system  includes  maintaining  data  bases,  interfaces, 
and  faci 1 i ties. 


5. 1.3.1  Maintain  an  Information  Data  Base,  with  Safeguards  for 

Configuration  Control  and  Security^ 


5. 1.3. 1.1  Maintain  a  Satellite  Systems  Data  Base.  This  includes: 


0) 

Maintain  a  file  of  reference  material  describing  the  space 
segment,  its  performance  capabilities  and  constraints. 

(2) 

Maintain  a  log  of  present  and  predicted  satellite  states 
and  parameter  values,  beginning  at  launch. 

(3) 

Maintain  files  of  trend  and  history  data. 

(4) 

Maintain  a  log  of  anomalies,  failures  and  failure 
analysis. 

(5) 

Maintain  a  current  representation  of  satellite  on-board 
software. 

(6) 

Maintain  the  capability  to  accurately  model  performance  of 
selected  systems. 

(7) 

Maintain  a  file  of  telemetry  parameter  limit  sense  values 
for  each  satellite. 

5. 1.3. 1.2 

Maintain  a  Navigation  Data  Base  -  See  Section  2.7. 

5. 1.3. 2 

Maintain  Required  DCA-SCF  Interfaces.  This  includes: 

(1) 

Maintain  the  capability  to  transmit  DCS-origi nated  command 
sequences  from  AFSCF  (via  SGLS)  using  the  teletype 
interface  between  the  two  agencies. 

(2) 

Maintain  the  backup  capability  at  the  DCS  to  transmit 
X-Band  satellite  housekeeping  commands  as  requested  by 
AFSCF. 

(3) 

Maintain  the  backup  capability  at  the  DCA  to  transmit 

X-Band  satellite  houskeepinq  commands  as  requested  by 
AFSCF. 
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5. 1.3. 3 


(4)  Maintain  the  capability  to  transmit  orbit  state  vector  data 
from  AFSCF  to  DCA  NCF  (via  DCAOC)  for  the  use  of  generating 
ephemeris  data. 

Maintain  Integrity  of  Ground  Supporting  Systems. 


5. 1.3. 3.1  Maintain  Capability  of  SIC  and  RTS  Hardware  to  Support 
Operations.  This  includes:  ~~ 

(1)  Conduct  routine  inspections  and  tests  of  equipment. 

(2)  Repair  equipment/restore  outages. 

(3)  Conduct  preventive  maintenance. 

(4)  Resolve  scheduling  or  tine-share  loading  conflicts  with 
other  users. 


5. 1.3. 3. 2  Maintain  Capability  of  STC  and  RTS  Software  to  Support 

TTperations  by  Exercising  Configuration  and  Change  Control . 


5. 1.3. 3. 3 


Maintain  STC  and  RTS  Personnel  Proficiency.  This  includes: 


(1)  Maintain  an  appropriate  training  capability. 

(2)  Test  and  maintain  individual  proficiency. 

(3)  Test  and  maintain  group  and  team  proficiency. 


5. 1.3. 3. 4 


Maintain  STC  and  RTS  Documentation  Currency.  This  includes: 


(1)  Maintain  a  file  of  reference  material  describing  the  ground 
segment. 

(2)  Maintain  a  current  log  of  performance  and  failure  reports 
for  ground  hardware. 

(3)  Maintain  current  operational  procedures. 


5.2 


DSCS  III  PAYLOAD  CONTROL  INTERFACES  WITH  MISSION/SPACECRAFT 
CONTROL 


The  payload  and  its  control  system  are  described  in  Section  1.3. 
Interfaces  between  payload  control  and  mission  control  are  described  in  Fiqure 
5-3,  above.  There  are  some  characteri sties  of  payload  control  operations 
which  have  a  bearinq  on  the  operations  of  the  autonomous  spacecraft.  These 
characteristics  are  described  here,  and  their  relations  to  the  autonomy 
options  are  discussed  in  Volume  III,  Section  5.2.3. 


5.2.1  Payload  Reconfiguration 

At  the  present  time,  reconf iguration  of  the  payload  for 
communication  network  changes  is  accomplished  through  the  SHF  telemetry  and 
command  link.  However,  switching  of  redundant  elements  to  mitigate  payload 
failures  is  done  by  AFSCF  through  the  S-Band  link. 


5.2.2  Timing 

The  payload  provides  a  timing  function  from  a  5  MHz  frequency 
standard.  The  signal  is  provided  to  users  via  the  SHF  beacons  which  are  part 
of  the  TT&C  subsystem.  The  frequency  of  the  frquency  standard  is  checked 
periodically  by  means  of  comparisons  between  the  SHF  beacon  signal  and 
information  obtained  from  the  S-Band  range  and  range  rate  tracking  function. 
If  the  frequency  standard  has  drifted  beyond  acceptable  limits,  frequency 
update  commands  are  sent  via  the  S-Band  link. 


5.2.3  Payload  Integrity  Maintenance 

Bus  and  payload  health  are  checked  periodically  by  the  AFSCF 
from  telemetry  data  contained  on  the  S-Band  link.  However,  the  SHF  telemetry 
through  the  beacons  contains  identical  information  to  the  S-Band  telemetry 
system  so  that  failures  will  often  be  detected  first  by  DCA  since  they  will  be 
receiving  the  beacon  signal  continuously.  Whenever  a  failure  in  either  the 
bus  or  the  payload  is  detected  it  is  normally  referred  to  AFSCF  for  diagnosis 
and  corrective  action  through  the  S-Band  command  link,  although  identical  SHF 
command  capability  is  available. 


5.2.4  Ephemeris  Information 

Epoch  orbital  state  vectors  are  presently  calculated  on  the 
ground  from  information  obtained  from  the  range  and  range  rate  tracking  data 
obtained  by  AFSCF  on  S-Band.  These  state  vectors  are  then  furnished  to  DCA 
for  ephemeris  propagation  between  epochs,  and  DCA  furnishes  ephemeris 
information  to  users  who  require  it. 


5.2.5 


SHF  Command  Failure 


There  are  at  least  two  single  point  failures  which  can  fail  the 
SHF  command  function.  The  first  is  the  decrypter.  The  second  is  the 
frequency  reference  standard  generator  output  from  the  comm  subsystem.  Only 
one  of  the  redundant  KI-24  decrypters  and  only  one  of  the  redundant  frequency 
reference  generators  are  on  at  any  one  time.  They  can  only  be  activated  by 
ground  command.  Thus,  if  the  decrypter  or  frequency  generator  fails  the 
S-Band  command  link  must  be  used  to  activate  the  redundant  units.  (Note  that 
the  switching  for  the  decrypter  inputs  and  outputs  and  the  input  from  the 
frequency  standard  may  also  represent  potential  single  point  failures. 
Sufficient  detail  was  not  available  to  assess  this  farther.) 


5.2.6  Command/Telemetry  Redundancy 

The  technical  capability  for  performing  all  telemetry  and 
command  functions  exists  at  either  SHF  or  S-Band.  Operationally,  the  ground 
procedures  are  strucured  as  indicated  above.  The  range  and  range  rate 
tracking  function  exists  only  at  S-Band. 
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APPENDIX  A 
LEVELS  OF  AUTONOMY 


LEVELS  OF  AUTONOMY 


(Reproduced  directly  from  Reference  1) 


In  performance  of  a  space  mission,  four  major  policy  goal 
categories  have  been  indentified.  These  are: 

(1)  Ground  interaction  reduction. 

(2)  Spacecraft  integrity  maintenance. 

(3)  Autonomous  features  transparency. 

(4)  On-board  resource  management. 


The  extent  to  which  these  goals  have  been  accomplished  to  date 
has  been  through  a  mix  of  functions  resident  in  either  the  space  segment  or 
the  ground  segment.  Furthermore,  the  ground  segment,  as  an  integral  part  of 
the  total  system,  has  been  responsible  for  accomplishing  maintenance, 
navigation  mission  control,  and  payload  data  processing.  Thus,  only  minimal 
spacecraft  autonomy  has  been  needed. 

The  levels  of  autonomy  described  in  this  appendix  are  used  to 
define  a  step-wise  increase  in  spacecraft  autonomous  capability.  By 
proceeding  through  the  levels,  autonomous  capability  is  increased  in  the  space 
segment  and  dependency  on  the  ground  segment  is  reduced. 

The  levels  of  autonomy  are  described  as  follows: 

Level  0.  A  design  without  redundant  elements  which  meets  all 
mission  needs  by  operating  without  the  on-board  control  of  state  parameters 
(such  as  rates  and  position).  May  respond  to  a  prespecified  vocabulary  of 
external  commands,  but  cannot  store  command  sequences  for  future  time-or 
event-dependent  execution  or  validate  external  commands.  (An  open-loop, 
on-board  system  controlled  from  the  ground.) 

Level  1.  Includes  Level  0  but  uses  on-board  devices  to  sense 
and  control  state  parameters  (such  as  rates  and  positions)  in  order  to  meet 
performance  needs.  Is  capable  of  storing  and  executing  a  prespecified  command 
sequence  based  on  mi ssion-critical  time  tags.  Will  respond  to  prespecified 
external  commands,  but  cannot  validate  external  commands.  Functionally 
redundant  modes  may  be  available  for  a  degraded-performance  mission. 

Level  2.  Include  Level  1  plus  the  use  of  block  redundancy. 
Ground-controlled  switching  of  spare  resources  is  required.  Uses 
cross-strapping  techniques  to  minimize  effect  of  critical  command  link 
(uplink)  failure  modes.  Significant  ground-operator  interaction  is  required 
to  restore  operations  after  most  faults  if  spare  spacecraft  resources  are 
available.  Requires  operator  interaction  for  fault  recovery.  Is  capable  of 
storing  and  executing  mission-critical  events  which  are  sensed  on-board  and 
may  be  independent  of  time. 
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Level  3.  Includes  Level  2  and  is  capable  of  sensing 
prespecified  mission-critical  fault  conditions  and  performing  predefined 
self-preserving  (entering  a  safe-hold  state)  switching  actions.  Is  capable  of 
storing  contingency  or  redundant  software  programs  and  being  restored  to 
normal  performance  (maintaining  the  command  link  with  a  single  link  fault)  in 
the  event  of  a  failure.  Timers  may  be  used  to  protect  resources.  Requires 
ground  operator  interaction  for  fault  recovery.  In  general,  the  failure  to 
sense  and/or  execute  the  mission-critical  event(s)  will  cause  mission  failure 
or  loss  of  a  major  mission  objective. 

Level  4.  Includes  Level  3  but  is  also  capable  of  executing 
prespecified  and  stored  command  sequences  based  on  timing  and/or  sensinq  of 
mission  events.  Ground-initiated  changes  to  command  sequences  may  be  checked 
on-board  for  syntactical  errors  (parity,  sign,  logic,  time).  Uses  coding  or 
other  self-checking  techniques  to  minimize  the  effects  of  internally  generated 
data  contamination  for  prespecified  data  transfers.  Requires  ground-operator 
interaction  for  fault  recovery.  In  general,  failure  to  sense  and/or  execute 
the  mission  event(s)  or  state-changes  (excluding  failure-induced 
state-changes)  will  cause  mission  failure  or  loss  of  a  major  mission 
objective. 


Level  5.  Includes  Level  4  and  is  also  autonomously 
fault-tolerant.  Is  capable  of  operating  in  the  presence  of  faults  specified 
a-priori  by  employing  spare  system  resources,  if  available,  or  will  maximize 
mission  performance  based  upon  available  capability  and/or  available 
expendables  (i.e.,  self-loading  of  contingency  programs)  without  ground 
i ntervention. 


Level  6.  Includes  Level  5  and  is  capable  of  functional 
commanding  with  on-board  command-sequence  generation  and  validation  prior  to 
execution.  Functional  commanding  may  include  a  high-level,  pseudo-English 
language,  spacecraft-system/operator  communication  and  control  capability. 

Level  7.  Includes  Level  6  and  is  capable  of  autonomously 
responding  to  a  changing  external  environment,  defined  a-priori,  so  as  to 
preserve  mission  capability.  The  capability  to  change  orbit  in  order  to 
compensate  for  degradation  or  to  protect  the  satellite  from  an  external  threat 
is  included. 


Level  8.  Includes  Level  7  and  is  capable  of  operating 
successfully  within  the  presence  of  latent  design  errors  which  could  cause 
loss  of  major  mission  objectives. 

Level  9.  Includes  Level  8  and  is  capable  of  task  deduction  and 
internal  reorganization  based  upon  anticipated  changes  in  the  external 
environment.  This  situation  is  exemplified  by  multiple  satellites  operating 
in  a  cooperative  mode.  In  the  event  of  a  satellite  failure,  remaining 
satellites  would  detect  autonomously  the  condition  (task  deduction)  and  may 
generate  and  execute  orbit-and  spacecraft-reconfiguration  commands. 
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level  10.  Includes  Level  9  and  is  capable  of  internal 
reorganization  and  dynamic  task  deduction  based  on  unspecified  and 
unknown/unanticipated  changes  in  external  environment.  The  system  will  strive 
to  maximize  system  utility.  Thus,  mission  objectives  should  be  adaptive  and 
automatically  reprogrammable.  System  resources  should  be  maximized  to 
preserve  task  adaptiveness. 
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B.  REQUIREMENTS  PLACED  ON  SPACECRAFT  BY  PAYLOAD*1 

The  performance  of  the  payload  is  dependent  on  the  requirements  it  levies 
on  the  S/C  bus.  This  Appendix  supplies  traceability  of  those  requirements 
from  the  payload.  During  design  of  the  autonomous  DSCS  III  these  requirements 
may  be  used  in  system  trades.  The  requirements  were  derived  from  References 
B-l  through  B-6. 


1.  Electric  Power  and  Distribution  System  (EPDS) 

The  payload  will  derive  electric  power  from  the  EPDS  which  collects, 
conditions,  stores,  and  distributes  power.  The  regulated  satellite  bus  will 
provide  a  nominal  +28  volts  ±0. 28  volts  over  all  satellite  load  conditions  and 
lifetime  as  measured  at  the  Power  Regulator  Unit  (PRU)  output. 

With  regard  to  Travelling  Wave  Tube  Amplifiers,  primary  and 
redundant  TWTA's  shall  not  be  operated  simultaneously  or  on  any  one 
communications  channel.  The  TWTA  turn-on  sequence  shall  be  staggered  to 
minimize  the  effects  of  transients  in  the  EPDS. 

The  communications  subsystem  power  requirements  are  presented  in 
Table  B-l.  In  the  normal  orbit  mode  of  operation  in  sunlight  or  eclipse,  the 
average  subsystem  demand  is  480.6  watts. 

There  are  other  communications  subsystem  average  heater  power 
dissipations  as  follows: 

TDAL  5.8  watts  (average) 

LNA  Oven  1.5  W  (solstice) 

17.0  W  (equinox) 

BFN-61  16.0  W 

GDA  3.2  W 

During  certain  transient  operations,  there  are  additional  power 
dissipations: 

GDA  driving  9.8  W  for  352  sec  per  day 

BFN-61  Reconfiguring  43.0  W  for  3  sec 

BFN-19  Reconfiguring  21.5  W  for  1  sec 

The  Single  Channel  Transponder  (SCT)  subsystem  power  requirements 
are  presented  in  Table  B-2;  average  and  peak  loads  are  shown  for  five  elements 
plus  power  controller  losses.  Table  B-3  shows  that  the  SCT  power  demand 
varies  from  0.0  watts  to  231.8  watts  depending  upon  the  selected  operating 
mode. 


*By  A.  M.  Goldman,  Jr. 
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TABLE  R-l  Communications  Subsystem  Power  Requirements 


COMPONENTS 

UNITS 

OPERATING 

AVERAGE 

POWER  DISSIPATION  (W) 

Frequency  Generator 

1 

8.24 

Frequency  Standard 

1 

2.50 

MBA  Low  Noise  Amp 

1 

1.80 

ECH  Low  Noise  Amp 

2 

3.60 

MBA  Ferrite  Drivers 

3 

0 

North  Panel  Ferrite  Drivers 

16 

0 

TDAL 

6 

5.04 

FET  Driver 

6 

8.00 

40  watt  TWTA  (Hughes) 

2 

242.00 

10  watt  TWTA  (Hughes) 

4 

154.30 

RLM  Switch 

1 

0.88 

TLM  Power  Monitor 

6 

2.70 

TWT  Input  RF  Relay 

2 

0 

TWT  Output  Waveguide  Switch 

2 

0 

CM) /TLM  Interface  Unit 

NP  Power  Controller  Losses 

1 

6.60 

(85%) 

1 

6.70 

Beam  Forming  Network  -  61 

1 

0.30 

Beam  Forming  Network  -  19 

2 

0.30 

JL  RF  Switch 

1 

1.35 

JL  RF  Detector 

1 

21.80 

JL  Digital  Controller 

SP  Power  Controller  Losses 

1 

8.35 

(85%) 

1 

5.70 

SUBSYSTEM  TOTALS 

480,60  Watts 
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TABLE  B-2  SCT  Power  Requirements 


AVERAGE  LOAD 

PEAK  LOAD 

COMPONENT 

(WATTS) 

(WATTS) 

Frequency  Synthesizer 

27.5  Standby 

35.3  Xmit 

Continuous 

Digital  Processor 

LSG  ON  LSG  OFF 

20.1  17.6  EAM  Store  &  Forward 

17.5  15.0  EAM  Bypass  or  Standby 

Continuous 

KI-35 

0.6  OFF 

6.5  ON 

Continuous 

UHF/SHF  Receiver 

2.5 

Continuous 

UHF  Transmitter 

137.2 

Continuous 

SCT  Power 

Controller  Losses 

15%  of  load 

Continuous 

TABLE  B-3  SCT  Power  Demand  by  Mode 


Mode  1. 


Mode  2. 


Mode  3. 


Mode  4. 


Standby 


(Frequency  Synthesizer,  Digital  Processor, 

55, 

,3W 

LSG 

ON 

Receiver,  SCT  Power  Controller) 

59, 

,2W 

K1-: 

35 

ON 

60. 

,1W 

LSG 

& 

KI- 

-35 

EAM  Store  and  Forward 

225, 

,0W 

LSG 

ON 

(Mode  1  plus  transmitter) 

229, 

,0W 

K1-: 

35 

ON 

231, 

,8W 

LSG 

& 

KI- 

-35 

EAM  Bypass 

222. 

.1W 

LSG 

ON 

(Mode  1  plus  Transmitter) 

226, 

,0W 

KI-: 

35 

ON 

228, 

,9W 

LSG 

& 

KI- 

-35 

Survival  Mode  (SCT  OFF) 

0, 

,0W 

2.  Attitude  Control  Subsystem  (ASC) 

The  payload,  which  includes  a  variety  of  communications  antennas, 
will  require  that  the  ACS  stabilize  the  spacecraft  and  maintain  it  in  a  stable 
attitude. 


When  the  spacecraft  is  on  station  in  geosynchronous  orbit,  the  ACS 
will  maintain  the  ACS  reference  axis  in  alignment  with  the  orbital  reference 
frame  within  the  3-sigma  accuracy  limits  stated  in  Table  B-4,  which  were  taken 
from  Reference  B-l . 


TABLE  B-4  ACS  ON-STATION  POINTING  ACCURACY 

Operating 

Roll 

Yaw 

Condition 

(Deg.) 

wESm 

(Deg.) 

On-station, 

+0.09 

+0.09 

+1.0 

steady-state 

Stationkeepinq 

+0.2 

+0.2 

+  1.0 

Payload  antenna  control  consists  of  electronically  reconfiguring  the 
fixed  Multiple  Beam  Antennas  (MBA's)  or  reorienting  the  steerable  Gimbaled 
Dish  Antenna  (GOA). 

Configuration  control  of  the  MBA  RFN's  and  pointing  control  of  the 
GOA  are  accomplished  by  the  Attitude  Control  Electronics  (ACE).  Uplink 
commands  for  the  BFN's  are  processed  by  the  TT&C  Command  Decoder  and  stored  in 
the  ACE.  The  ACE  microprocessor  formats  the  data  and  sends  the  commands  to 
the  BFN  Central  Electronics  (CE)  when  commanded.  Serial  digital  telemetry 
from  the  BFN  is  stored  in  the  Attitude  Control  Electronics  and  relayed  to  the 
downlink  telemetry. 

The  GDA  receives  electrical  power  from  the  ACS  for  operating  gimbal 
actuator  stepper  motors.  The  GDA  contains  potentiometers  that  provide  a 
position  indication  for  both  the  X  and  Y  axes  by  means  of  a  calibrated  dc 
voltage  of  5  volts.  Analog  position  information  is  converted  to  digital  in 
the  ACS  Analog  to  Digital  (A/D)  converter.  These  positional  data  are  placed 
in  the  ACE  memory  and  relayed  to  the  TT&C  Subsystem  for  the  downlink 
telemetry. 


3.  Thermal  Control  Subsystem  (TCS) 

The  payload  will  require  both  active  and  passive  thermal  control  by 
the  TCS.  Passive  techniques  will  be  applied  to  the  communications  antennas 
(MBA-61,  twin  MRA-19,  GDA,  and  twin  ECH)  and  to  the  SCT  HHF  antennas.  Active 
techniques  will  be  applied  to  payload  elements,  such  as  TWTA's  and  LNA's  for 
the  Comm  and  SCT  subsystems  mounted  on  the  spacecraft  bus  North  and 
South  panels,  respectively. 

No  temperature  control  limits  for  subsystem  elements  are  stated 
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here.  However,  estimates  of  maximum  and  minimum  expected  on-orbit 
operational  temperatures  may  be  found  in  Section  7  of  Reference  B-2. 

From  section  2.3.4,  we  observe  that  temperature  control  is  primarily 
autonomous  through  the  use  of  thermostats,  but  that  the  ground  does  have 
discretionary  control  if  required  from  an  analysis  of  telemetry  data.  The 
normal  control  mode  is  through  the  thermostatical ly  controlled  heaters. 

These  heaters  provide  active  thermal  protection  for  structure  and/or 
components  from  the  specified  minimum  temperatures.  Two  levels  of  control  are 
provided.  The  first  level  of  thermal  control  is  provided  by  heater  circuits 
called  control  heaters.  The  control  heaters  maintain  temperatures  above  the 
minimum  operating  temperatures  for  their  associated  components.  The  control 
heater  circuits  power  is  controlled  by  discrete  commands  from  the  TT&C  while 
their  actual  heating  cycle  is  controlled  by  thermostats.  All  control  heater 
power  is  removed  automatically  by  the  Load  Shed  Relay  except  for  PS,  ACS  and 
battery  heaters. 

The  second  level  of  thermal  control  is  provided  by  heater  circuits 
called  survival  heaters.  The  survival  heaters  maintain  temperatures  above  the 
minimum  survival  (nonoperating)  temperature  limits.  Survival  heater  power  is 
provided  continuously  and  is  not  commandable. 

Each  heater  circuit  has  a  thermostat  to  control  the  heater  duty 
cycle  to  maintain  its  temperature  (either  control  level  or  survival  level). 
Each  circuit  also  has  an  over-temperature  thermostat  to  protect  against  a 
failed  closed  heater  circuit.  All  thermostatically  controlled  heater  circuits 
are  redundant. 

The  payload,  of  course,  will  also  require  specific  levels  of  thermal 
control  during  other  mission  phases  such  as  prelaunch,  launch,  and  orbit 
transfer. 


4.  Structure  Subsystem 

The  payload  places  requirements  on  the  Structure  Subsystem  with 
regard  to  mechanical  alignment  of  the  antennas  as  shown  in  Table  B-5. 
Three-sigma  root-sum-square  values  are  given. 


TABLE  B-5  MECHANICAL  ALIGNMENT  REQUIREMENTS  (DEGREES) 


Narrow  Coverage  Antennas 

Earth  Coverage  Antennas 

GDA 

1 

MBA’s 

MBA's 

ECH's 

SCT's 

Roll 

r 

Pitch 

Yaw 

Roll 

Pitch 

Yaw 

Roll 

Pitch 

Roll 

Pitch 

Roll 

Pitch 

o.m 

0.06 

0.01 

0.02 

0.02 

0.02 

0.02 

0.02 

0.07 

0.07 

0.25 

0.25 

133 


5.  Telemetry,  Tracking  and  Command  (TT&C)  Subsystem 

The  payload  requires  commands  from  the  qround.  The  payload  also 
telemeters  to  the  ground  data  on  its  performance,  status,  and  health.  These 
functions  are  supplied  by  the  TT&C.  A  discussion  of  payload  tracking 
requirements  will  be  deferred  to  the  navigation  subsection. 

The  Comm  payload  provides  the  antenna  capability  for  the  SHF 
telemetry  and  command  links.  It  will  receive,  filter,  preanpl i fy  and  provide 
SHF  ground  command  transmissions  on  channels  1  and  5.  The  RF  Interface 
between  the  Comm  and  TT&C  subsystems  is  defined  at  the  input  port  to  the 
SHF-to-S-Band  downconverter.  The  Comm  subsystem  will  also  provide  a  Command 
and  Telemetry  Interface  Unit  ( I FU )  which  is  digital  and  separate  from  the  RF 
interface  with  the  TT&C.  This  unit  processes  commands  cominq  into  the  payload 
from  the  TT&C  and  telemetry  coming  into  the  TT&C  from  the  payload.  The  Comm 
subsystem  also  provides  a  stable  frequency  reference  to  the  TT8C  down 
converters. 

The  Comm  Subsystem  is  operated  and  controlled  by  commands  and 
telemetry  through  TT8C  Subsystem  SHF  and  S-Band  RF  links.  Both  discrete 
commands  and  message  commands  are  used  to  provide  subsystem  configuration  and 
mode  control ,  antenna  pattern  control  and  communications  parameter  adjustment 
capability.  Bi-level,  analog  and  serial  data  telemetry  are  used  to  verify 
command  execution  and  subsystem  performance. 

Commands  affecting  the  Comm  Subsystem  are  routed  from  the  Command 
Decoder  to  any  one  of  several  satellite  locations  for  processing  and 
implementation.  These  include  the  North  Panel  Power  Controller  (NPC),  the 
Command  and  Telemetry  Interface  Unit  ( I FU ) ,  the  South  Panel  Power  Controller 
(SPC)  and  the  Jammer  Location  Electronics  (JLE).  In  addition,  MBA 
reconf iguration  commands  are  processed  by  the  Attitude  Control  Electronics 
(ACE),  which  subsequently  controls  the  reconfiguration  execution. 

Commands  to  reconfigure  the  communication  network  (e.g.,  changing 
antenna  pointing)  are  normally  sent  via  the  SHF  link;  commands  to  mitigate 
failures  (e.g.,  switching  in  redundant  TWTA's)  are  normally  sent  via  the 
S-band  link.  However,  the  technical  capability  must  exist  to  send  any  command 
by  either  link. 

Processing  of  Comm  subsystem  discrete  commands  and  generation  of 
bi-level  and  analog  telemetry  is  relatively  simple  and  straightforward. 
However,  message  command  processing  and  serial  data  telemetry  generation  is 
generally  more  complex.  Many  commands  involve  operation  of  the  IFU,  the  NPC 
and  its  ferrite  Switch  Relay  Tree,  and/or  the  JLE.  MBA  reconfiguration  and 
Gimbaled  Dish  Antenna  message  command  processing  involve  data  processing  and 
storage  by  the  ACE,  and  reconfiguration  execution  under  control  of  the  ACE 
software.  In  addition,  the  communications  subsystem  relies  on  dedicated 
ground  software  -  the  Communications  Configuration  Program  (CCP)  and  the 
Telemetry  Command  Program  (TCP). 
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The  Comm  subsystem  uses  both  discrete  and  message  commands. 

Discrete  commands  generally  perform  a  single  function  such  as  turn  off  of  a 
particular  component  or  switching  redundant  components  by  setting  or  resetting 
latching  relays.  Message  commands  are  used  to  transmit  data  to  the 
Communications  subsystem  and  to  set  up  or  execute  more  complicated  operations. 
Eighty-one  discrete  and  17  message  commands  received  from  the  satellite  TT&C 
subsystem  are  used  to  control  the  communications  subsystem.  Figure  B-l  shows 
the  satellite  components  where  the  command  processing  takes  place.  The 
following  should  be  noted: 

(1)  All  MBA  and  BEN  configuration  commands  are  processed  by  the  ACE. 

The  only  exception  is  the  selection  of  the  prime  or  redundant 
Central  Electronics  by  discrete  command  which  is  processed  by 
each  Central  Electronics.  Reconf iguration  data  contained  in 

message  commands  is  processed  and  stored  in  the  ACE  until  the 
execution  is  initiated  by  discrete  command  to  the  ACE. 

(2)  All  other  Comm  subsystem  commands  except  JLE  commands  are 
processed  by  the  IFU.  Control  signals  are  then  applied  to  the 
specific  Comm  subsystem  component  either  directly  or  after 
further  processing  on  the  North  Panel  Power  Controller  (NPC). 

(3)  Most  discrete  commands  which  are  used  to  turn  on  power,  or  make 
selections  in  other  Communications  subsystem  components  are 
processed  by  the  NPC  which  sets/resets  a  latching  relay  to 
apply/remove  power,  select  components,  etc. 

These  discrete  commands  are  executed  by  connecting  latching  relay 
coils  to  specific  top  and  bottom  switches  of  the  Command  Decoder  matrix. 
Routing  of  message  commands  is  accomplished  by  means  of  a  Precursor  word  which 
is  the  first  word  of  any  message  command  to  the  satellite.  This  word  is 
decoded  by  the  Command  Decoder  to  determine  the  message  destination  and  number 
of  message  words  to  follow. 

Commands  may  be  sent  individually  or  in  sequences  composed  of  many 
discrete  commands  and/or  message  commands.  Each  message 'command  in  a  sequence 
may  contain  up  to  64  message  words.  The  command  sequences  may  be  generated 
and  sent  manually  by  the  command  operator  or  generated  automatically  by  the 
CCP  software  and  transmitted  under  control  of  the  TCP  software  after 
initiation  of  the  sequence  by  the  operator. 

Eighty-nine  bi-level,  116  analog  and  8  serial  data  telemetry 
functions  transmitted  by  the  satellite  TT&C  Subsystem  are  used  to  monitor 
command  execution,  and  Comm  subsystem  performance,  health  and  status.  Most 
telemetry  sensors,  pick-offs  and  associated  conditioning  circuits  are  located 
in  the  specific  component  they  are  monitoring  and  are  sampled  periodically  by 
the  TT&C  Subsystem.  Serial  telemetry  is  provided  by  the  IFU  and  JLE.  The  MBA 
BFN  ferrite  state  data  is  read  out  of  the  ACE  where  it  is  stored  after  the 
reconfiguration. 
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JLE  MODE  CONTROL  (MSG) 


Figure  B-l.  Command  Paths  and  Processing 


All  serial  digital  telemetry  is  connected  to  the  Master  Telemetry 
Unit  on  the  South  panel,  while  all  bi-level  and  analog  telemetry  is  connected 
to  the  Remote  Telemetry  Unit  located  on  the  North  panel.  Virtually  identical 
telemetry  streams  are  sent  simultaneously  over  the  SHF  and  S-Band  links. 

A  vital  spacecraft  and  Communications  network  function  is  timing.  A 
redundant  5.0  MHz  Frequency  Standard  in  the  payload  is  used  to  supply  a 
reference  frequency  to  the  SHF-to-S-band  downconverter,  S-band-to-IF 
downconverter,  and  to  the  two  SHF  beacons.  The  5.0  MHz  distribution  network 
is  contained  in  the  frequency  generator  and  provides  the  output  signal  levels 
into  nominal  50  ohm  loads.  The  TT&C  subsystem  must  furnish  frequency  update 
commands  from  the  ground  to  the  reference  Frequency  Standard. 

The  initial  error  in  the  downconverter  and  mixer  injection  signals, 
code  generator,  and  beacon  frequencies  shall  not  exceed  1  ppm  (3  sigma).  The 
stability  shall  be  better  than  the  requirements  specified  in  Table  R-fi. 

All  short-term  frequencies  shall  satisfy  the  requirements  of  Table 
B-6  within  four  hours  after  turn-on.  The  frequency  stability  shall  be  better 
than  1  ppm  (3  sigma)  within  one  hour  after  turn-on  under  all  conditions. 


TABLE  B-6  MINIMUM  FREOUENCY  STABILITY  REOUIREMENTS* 


Parameter  ~~ 

Communications 

Beacon  Code 

[“  AF5ATC0M  “SCT ' 

Short  Term  Stability 
0.1  sec 

0.001  sec 

Long  Term  Stability 

1  hour  after  turn-on 
24  hours 

Per  month 

Long  Term  Stability 
(over  spacecraft 
life) 

5x10-1°  (1  sigma) 

lxlO-6  (3  sigma) 

lxlO-8  (3  sigma) 
3xl0-6  (3  sigma) 

_ 

lxlO-8  (1  sigma) 

1x10-6  (3  sigma) 

lxlO-6  (3  siqma) 
3x10”! 1 

3x10-9 

"All  short  term  requirements  shall  be  satisfied  within  4  hours  after 
turn-on. 

6.  Navigation 

The  navigation  function  relies  on  tracking  data  from  the  TT&C 
subsystem,  ground  computation,  and  on  the  spacecraft  Propulsion  Subsystem 
(PS).  The  navigation  function  involves: 

(1)  Obtaining  spacecraft  ranging  and  Doppler  tracking  data; 

(2)  Ground  computation  of  spacecraft  position  and  velocity  as  a 
function  of  time  (the  ephemeris),  and  the 

(3)  Computation,  commanding,  and  execution  of  spacecraft 
stationkeeping  maneuvers  using  the  PS. 
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The  payload  places  requirements  on  stationkeepinq  accuracy. 
North-South  excursions  from  the  equatorial  plane  must  be  limited  to  +0.1 
degrees  in  orbit  inclination.  East-West  excursions  from  the  assignee! 
longitudinal  station  must  be  limited  to  +0.1  degrees. 

Spacecraft  users  require  that,  at  any  time,  the  location  of  the 
satellite  relative  to  any  ground  station  from  which  it  is  visible  with  an 
elevation  angle  of  7.5  degrees  or  more  must  be  known  to  a  range  accuracy  of 
9400  meters  or  less.  The  relative  velocity  must  also  be  known  to  0.19 
meters/second  or  less. 

The  navigation  function  is  required  to  provide  users  with  orbital 
state  vectors  (spacecraft  position  and  velocity)  of  sufficient  accuracy  that 
the  existing  user  ephemeris  propagation  can  meet  the  previously  stated  9400 
meter/0.19  meter/second  requirement  at  all  times  between  the  receipt  of  state 
vector  updates.  It  is  required  that  the  user  ephemeris  propagation  maintain 
this  required  accuracy  for  five  days  between  updates,  with  a  goal  of  21  days 
between  state  vector  updates  from  the  navigation  function. 
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APPENDIX  C 

ACS  MICROCOMPUTER  ARCHITECTURAL  CHARACTERIZATION 


C.  ACS  MICROCOMPUTER  ARCHITECTURAL  CHARACTERIZATION* 

Fiqure  C-l  is  a  block  diagram  of  the  computer.  The  description  of  the 
computer  in  this  Appendix  is  based  on  available  literature  and  is  subject  to 
the  constraints  discussed  in  the  preface  to  Volume  I. 


1.0  Central  Processor  Unit  (CPU) 

The  CPU  is  a  microprogrammed,  16-bit,  parallel,  digital  processor. 
LSI11  processors  of  similar  vintage  have  direct  addressing  capability  to  32k 
words  of  memory.  The  CPU  can  address  memory  in  two  modes;  word  (16  bits)  and 
byte  (8  bits).  Word  addresses  are  alway  even-numbered.  Byte  addresses  are 
even  and  odd-numbered.  CPU  instructions  occupy  whole  address  words.  The  CPU 
with  dedicated  power  supply  is  block  redundant  and  is  powered  on  a  strobed 
basis.  The  strobe  is  activated  by  a  1.024  second  cycle  clock  which  is 
synchronized  to  the  Telemetry,  Tracking  and  Command  (TT&C)  subsystem  main 
frame  sync  pulse  (2.048  seconds).  The  power  strobe  is  terminated  by  a  control 
signal  generated  when  a  'halt'  instruction  is  executed  in  software.  The  CPU 
is  under  the  control  of  the  'embedded  flight  software  program'  stored  in 
nonvolatile  Read-only  Memory  (ROM).  The  CPU  uses  volatile  Random  Access 
Memory  (RAM)  as  a  'scratch  pad'  for  control  algorithms.  The  CPU  uses  hardened 
RAM  (HRAM)  to  store  critical  RAM  data  which  can  be  loaded  back  into  RAM 
following  detection  of  a  nuclear  event  or  a  power  off/on  event.  The  CPU 
interfaces  with  the  rest  of  the  system  via  the  digital  bus.  LSI11  design 
allows  for  vectored  interruption  of  the  CPU  by  devices  on  the  digital  bus  (see 
B.2  below).  The  interrupt  vector  is  a  reserved  address  pointer  to  memory 
where  the  interrupt  service  routine  for  the  particular  device  is  located.  The 
priority  of  the  interrupt  is  determined  by  the  physical  proximity  of  the 
device  to  the  CPU  on  the  bus.  The  CPU  can  enable  or  disable  all  interrupts. 
Although  this  is  a  capability  of  LSIll-type  systems,  it  does  not  appear  to  be 
the  manner  in  which  the  ACS  microcomputer  devices  are  configured.  One  bus 
signal  line  functions  as  an  external  event  interrupt  line  to  the  CPU.  When 
configured,  this  line  has  the  highest  priority.  A  special  interrupt  vector 
address  is  reserved  for  this  function.  It  has  not  been  determined  if  this 
interrupt  is  being  used  in  the  ACS  microcomputer  design. 


2.0  Digital  Bus  (BUS) 

The  digital  bus  structure  links  the  CPU  with  memory  and  all  other 
peripheral  devices.  It  is  comprised  of  50  nonredundant  lines.  Parallel, 
16-bit  address  lines  interface  CPU  to  memory  and  input/output  (I/O) 
peripherals  (ports).  Parallel,  bi-directional,  16-bit  data  lines  transmit 
read/write  data  between  CPU  and  memory  ports.  Three  lines  control  read/write 
synchronization.  Eiqht  interrupt  lines  are  provided  for  the  telemetry  port. 
Their  function  is  not  understood  to  date.  Seven  lines  provide  clock  and 
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Figure  C-l.  ACS  Microcomputer  Block  Diagram 


timing  signals.  The  bus  is  under  the  direct  control  of  the  CPU,  which  is 
responsible  for  meeting  port  timing  restrictions.  Bus  communications  are 
asynchronous  to  provide  automatic  compensation  for  clock  skews  and  varying 
memory  I/O  port  response  times.  Data  transfer  is  accomplished  using  program 
initiated,  memory  mapped  I/O,  i.e.,  each  device  on  the  bus  is  assigned  a 
special  memory  address  and  the  CPU  passes  data  to  and  from  the  device  as 
though  memory  was  being  addressed.  Bussed  units  are  power  switchable  such 
that  any  failed  unit  (CPU,  memory,  I/O  port)  can  be  totally  isolated  from  the 
bus.  Redundancy,  via  cross  strapping,  is  achieved  by  selectively  powering 
desired  units. 

3.0  Read  Only  Memory  (ROM) 

The  ROM  is  a  nonvolatile,  block  redundant,  8k  by  16-bit  memory. 

Only  one  ROM  is  powered  at  a  time  and  is  power  strobed  in  a  similar  fashion  to 
the  CPU.  ROM  is  interfaced  with  the  rest  of  the  system  via  the  bus.  The 
operating  speed  is  less  than  10  microseconds.  ROM  houses  permanent,  nearly 
unalterable  computer  program  instructions/constants  (embedded  flight  software) 
to  control  operation  of  the  ACS  and  BFN.  This  program  is  executed  by  the  CPU 
on  a  1.024  second  cycle.  The  ACS  portion  of  the  program  executes  each  cycle 
and  the  BFN  portion  executes  on  command  from  the  ground.  ACS  program 
execution  will  not  exceed  400  milliseconds  running  time  and  the  BFN  portion 
will  not  exceed  500  milliseconds.  This  program  can  be  modified  in  a  limited 
way  by  using  the  redundant  RAM  (lk)  to  store  selected  ROM  patches.  Certain 
ROM  memory  locations  are  reserved  for  interrupt  and  trap  handling.  Interrupt 
memory  locations  are  discussed  under  CPU,  above.  Traps  are  special  interrupt 
vector  locations  used  for  conditions  such  as:  bus  device  time-out  (addressed 
device  does  not  respond  within  a  certain  time  interval),  illegal  CPU 
instruction  code,  and  software  instruction  forced  traps. 


4.0  Random  Access  Memory  (RAM) 

The  RAM  is  a  volatile,  block  redundant,  lk  by  16-bit  memory. 

Normally  one  RAM  is  powered  at  a  time.  However,  the  redundant  RAM  can  be 
powered  to  operate  in  a  'RAM  patch'  mode  to  provide  limited  ROM  reprogramming. 
The  RAM  is  interfaced  with  the  rest  of  the  system  via  the  bus.  RAM  read/write 
speed  is  less  than  10  microseconds.  The  RAM  houses  variable  data  computed  and 
used  by  control  algorithms  and  allows  programming  flexibility  to  perform 
double  precision  multiply  and  divide  processing. 


5.0  Hardened  Random  Access  Memory  (HRAM) 

The  HRAM  is  a  4  word  by  16  bit  memory.  There  are  eight  HRAM's, 
only  six  of  which  are  normally  powered  and  required  for  normal  operations. 

The  two  remaining  HRAM's  provide  functional  redundancy.  Any  or  all  of  them 
can  be  powered.  The  HRAM  is  interfaced  with  the  rest  of  the  system  via  the 
bus.  HRAM  read  speed  is  15+  or  -10  microseconds.  The  write  speed  is  156+  or 
-10  microseconds.  HRAM's  are  made  up  of  individual  'slow'  flip-flop  cells  for 
each  bit  of  hardened  Information.  HRAM  is  used  to  store  RAM  variables  which 
must  not  be  lost  If  a  nuclear  event  is  detected  or  if  the  RAM  experiences  a 
power  off /on  event. 
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6.0 


Input/Output 


Sixteen  peripheral  devices  (ports)  of  different  types  are  on  the 
bus.  All  are  redundant  (block  or  functional)  but  one,  the  Gimbaled  Dish 
Antenna  (GDA)  port.  Ports  are  interfaced  to  attitude  control  actuators, 
analog  sensors,  command  and  telemetry  hardware  (TT&C),  beam  forming  network 
(BFN)  electronics,  clock  and  timing  hardware  and  special  event  (nuclear) 
detectors.  Ports  are  operated  using  program-initiated  I/O  transfers  (memory 
mapped  I/O)  vs  interrupt-initiated  I/O  transfer  (interrupt  vector  I/O). 


6.1  Reaction  Wheel  (RW)  Ports 

There  are  four  RW  ports,  one 
Any  three  can  provide  proper  control, 
the  tachometer  select  command  from  the 
count  data  to  the  CPU  when  polled. 


per  RW.  All  four  are  normally  powered. 
The  port  outputs  the  RW  drive  count  and 
CPU.  The  port  inputs  the  RW  tachometer 


6.2  Thruster  Ports 

There  are  eight  ports  configured  as  four  complementary  pairs,  e.g., 
pitch  a/b,  roll  a/b,  etc.  Only  one  of  each  pair  is  powered.  The  ports 
provide  thruster  solenoid  activation  in  the  mode,  direction  and  duration 
commanded  by  the  CPU.  The  ports  input  thruster  valve  firing  status  to  the 
CPU  when  polled. 


6.3  Solar  Array  Drive  (SAD)  Ports 

There  are  two  ports,  one  per  SAD  stepper  motor.  One  is  normally 
powered.  Both  can  be  operated  for  higher  torque  levels.  The  port  provides 
motor  drive  stepping  in  the  direction  and  rate  commanded  by  the  CPU.  SAD 
drive  modes,  the  normal  RATE  mode  and  the  SLEW  mode  are  selected  by,  and 
stored  in,  a  flag  in  the  CPU. 


6.4  Gimbaled  Dish  Antenna  (GDA)  Port 

There  is  one  nonredundant  port  dedicated  to  the  GDA  gimbal  motors. 
The  port  provides  motor  drive  stepping  on  the  X  and  Y  axis  in  the  direction 
and  slew  angle  commanded  by  the  CPU. 


6.5  Analog  Sensor  Ports 


There  are  two  ports,  each  comprised  of  an  analog  signal  buffer, 
multiplexer,  decoder  and  a/d  converter.  Both  signal  buffers  are  always 
powered.  Only  one  mux,  decoder  and  a/d  converter  is  powered.  Each  port  uses 
both  signal  buffers  and  one  set  of  mux,  decoder  and  a/d  converter  to  input 
digitized  signals  for  positive  and  negative  pitch  and  roll  sun  sensor 
attitude,  pitch  and  roll  earth  sensor  error,  rate  gyro,  SAD  potentiometer,  GDA 
X  and  Y  axis  potentiometers  to  the  CPU,  when  polled. 
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6.6 


Clock  and  Timing  Ports 


There  are  two  ports  which  can  drive  seven  lines  on  the  bus.  Only 
one  port  is  normally  powered.  The  port  inputs  a  1.024  second  pulse 
synchronized  to  the  TT&C  main  frame  sync  pulse  and  six  other  clock  frequencies 
for  al 1  bus  users. 

6.7  Nuclear  Event  Detector  Ports 

There  are  two  ports,  one  is  normally  powered.  The  port  inputs  a 
one-bit  status  indication  of  the  occurrence  of  a  radiation  event  when  polled 
by  the  CPU.  When  the  event  signal  is  read,  the  status  indicator  is 
automatical ly  reset,  making  the  port  ready  to  input  the  next  event  occurrence. 
Special  CPU  processing  is  initiated  when  the  event  is  sensed. 


6.8  8FN  Ports 

There  are  two  ports.  Only  one  is  normally  powered.  Each  port  is 
dedicated  to  one  of  two  BFN  central  electronics  packages.  This  port  operates 
differently  from  other  ports,  in  that  no  feedback  signal  is  returned  by  the 
port.  The  transmitted  commands  are  assumed  to  be  completed  in  open-loop 
fashion,  in  a  prespecified  time. 


6.9  Telemetry  Ports 

There  are  two  telemetry  ports,  each  consisting  of  a  64  word  by  8  bit 
RAM  which  buffers  data  from  the  CPU  and  holds  it  until  removed  by  the  TT&C. 
Only  one  port  is  normally  powered.  The  port  outputs  serial,  digital  data  of 
selected  ACS  and  BFN  operating  and  commanded  values,  stored  in  RAM,  from  the 
CPU  to  the  TT&C.  Bi-level  and  analog  data  is  not  provided  through  the  port. 
Insuring  that  the  port  RAM  is  loaded  with  the  correct  data,  prior  to  the  point 
in  time  the  TT&C  sampling  operation  begins,  is  a  responsibility  of  the  CPU 
under  ROM  control.  A  port  'RAM  not  empty'  status  indicator  is  input  to  the 
CPU  when  the  port  is  polled,  and  is  used  to  reload  the  port  RAM  after  being 
emptied  by  TT&C.  The  read  command  sets  flip-flops  indicating  master  frame 
(one/61.44  sec.),  main  frame  (one/2.048  sec.),  and  interrupt  mode  status  for 
use  by  the  ACS  software;  and  the  timing  is  synchronized  with  the  TT&C 
subsystem. 


6.10  Command  Ports 

There  are  two  message  command  ports,  each  consisting  of  a  16-word  by 
20  bit  RAM  which  buffers  message  commands  from  the  TT&C  command  decoders 
(CD's)  to  the  CPU.  Only  one  port  is  normally  powered.  The  CPU  and  the  TT&C 
CD's  share  access  to  the  port  RAM  on  an  asynchronous  basis.  The  CPU  can 
command  a  request  for  uninterrupted  access  to  the  port  RAM  to  empty  it  each 
execution  cycle.  The  port  inputs  18  bits  of  message  command  data  and  two  bits 
of  abort  and  enable  status  indicators,  hence  20  bits.  The  message  command 
data  is  used  to  modify  RAM.  The  status  indicators  are  used  to  control  the 
processing  of  sequences  of  message  commands.  Two  input  operations  are 
required  to  obtain  each  20  bit  message  command  from  the  port. 


6.11 


DC  Matrix 


Two  identical  diode  latching  relay  matrices  provide  nonvolatile 
storage  of  discrete  commands  issued  by  the  TT&C  CD's.  Both  are  always  active. 
Approximately  60  of  these  discrete  commands  generate  status  indicators  which 
are  ready  by  the  CPU  and  are  used  to  control  various  processing  algorithms. 
Discrete  commands  are  used  to  select  redundant  bus  elements,  enable/disable 
for  automatic  modes  (e.g.,  auto  earth  acquire),  and  for  selection  of 
processing  parameters  in  ROM  or  RAM. 


7.0  ROM  PROGRAM 

The  ACS  and  8FN  programs,  stored  in  nonvolatile  ROM  and  executed  by 
the  CPU,  give  the  ACS  its  character.  The  ACS  program  is  executed  to 
completion  each  CPU  execution  cycle.  This  is  assured  by  the  use  of  the  1.024 
second  CPU/ROM  power  strobe  and  the  careful  sizing  and  programming  of  the  ROM 
so  that  control  functions  are  processed,  ports  are  serviced  and  the  ROM  'halt' 
instruction  is  executed  (to  terminate  the  power  strobe)  within  a  time  period 
less  than  the  CPU  execution  cycle.  Some  port  processing,  such  as  command  and 
telemetry,  requires  special  timing  within  each  execution  cycle.  When  the  CPU 
is  powered,  the  ROM  program  executes  in  a  functional,  straight-line  manner. 
Within  each  functional  area,  loops  and  subroutine  calls  are  used.  Higher 
priority  functions  such  as  ci rcumventive,  telemetry,  and  input  conditioning 
are  processed  first.  Ports  are  serviced  in  a  polling  fashion,  i.e.,  they  are 
written  to  and  read  from  at  the  discretion  of  the  ROM  program  execution  and 
are  not  allowed  to  initiate  their  own  request  for  service,  which  would 
interfere  with  ROM  program  timing.  Program  interruption  is  used  sparingly  to 
handle  CPU  memory,  port  faults  or  is  under  ROM  program  control  to  accomplish 
RAM  patching.  Message  commands  from  TT&C  can  be  used  to  modify  RAM  contents 
(variables).  Discrete  commands  (DC's)  from  TT&C  (to  the  latching  relay 
matrix)  are  used  to  configure  redundant  units  on  the  bus,  select  a  limited  set 
of  control  algorithm  and  port  processing  modes,  constants  stored  in  ROM  or 
variables  stored  in  RAM.  ROM  'reprogramming'  can  be  performed  by  using  the 
redundant  RAM  to  house  the  patch  program  and  establishing  a  link  from  ROM. 


7.1  MAJOR  ROM  PROGRAM  PROCESSES 


7.1.1  Power  Up 

The  CPU/ROM  is  powered  off/on  each  1.024  second  cycle.  The 
determination  that  this  is  the  normal  CPU/ROM  strobe  power,  or  a  power  off/on 
condition  which  could  seriously  affect  subsequent  processing,  is  made  by 
checking  RAM  memory  for  the  presence  of  special  'sync'  words.  When  the  sync 
words  are  not  intact  (indicating  a  non-normal  power  off/on  or  possible  nuclear 
event),  the  RAM  is  cleared,  the  RAM  sync  words  are  reestablished,  HRAM  values 
are  written  to  RAM,  RAM  patching  is  disabled  and  the  telemetry  and  command 
ports  are  initialized. 
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7.1.2 


Ci rcumventi ve 


This  logic  is  executed  if  nuclear  event  detection  or  CPI)  address 
instruction  faults  have  occurred  during  the  last  CPU  execution  cycle.  Event 
detection  and  CPU  address  instruction  faults  disable  RAM  patching  and  cause 
the  bypassing  of  subsequent  attitude  control  algorithms  which  use  the  sun 
sensors  for  a  period  of  32  CPU  execution  cycles. 

7.1.3  Telemetry 

There  are  two  telemetry  functions:  normal  and  interrupt  telemetry 
processing.  Normal  processing  consists  of  providing  34  bytes  (1  byte  =  R 
bits)  of  data,  each  CPU  execute  cycle  to  the  port  RAM.  Data  contents  vary 
between  two  CPU  execution  cycles  which  comprise  the  2.D48  second  TT&C  main 
frame.  In  addition,  twelve  different  processing  modes  and  five  different 
formats  are  available  to  convert  data  for  the  output  telemetry  stream. 
Interrupt  telemetry  is  from  BFN  only.  The  processing  consists  of  providing  64 
bytes  of  data  four  times  each  CPU  execute  cycle,  to  the  port  RAM.  The  TT&C 
reads  the  port  RAM  after  each  load. 


7.1.4  Attitude  Control 

This  processing  commands  the  thrusters,  RW,  SAD  and  GDA  ports  based 
upon  sensor,  RW  tach,  and  command  inputs.  Processing  starts  by  reading 
sensors,  RW  tachs  and  discrete  command  status,  accessing  ROM  and  RAM  operating 
values  and  then  decoding  and  scaling  this  data  for  subsequent  control-loop 
processing.  Inner  and  outer  control-loop  processing  is  then  performed.  Inner 
control-loop  processing  is  performed  each  CPU  execute  cycle.  Inner  control 
accepts  outer  loop  attitude  error  estimates  and  commands  the  RW  port  to  null 
the  estimates,  senses  the  RW  tach  response,  calculates  the  corrected  error 
factors  achieved  and  updates  the  attitude  error  estimates.  Attitude  estimates 
are  comprised  of  pitch,  yaw,  roll  and  RW  momentum  elements.  The  outer  control 
loop  processing  is  done  every  16  CPU  execute  cycles  for  normal  on-orbit 
operations  or  every  2  CPU  execute  cycles  for  maneuvers.  Outer  loop  processing 
uses  read-sensor  data  to  calculate  attitude  and  rate  errors,  and  updates  the 
attitude  and  RW  momentum  error  estimates.  Errors  are  the  difference  between 
estimated  and  sensed  attitude.  The  outer  loop  also  drives  the  thruster  ports 
for  maneuvers  and  RW  unloading.  SAD  and  GDA  port  processing  is  performed 
1  ast. 


7.1.5  Message  Commmand 

Command  processing  reads  message  commands  from  the  RAM  port,  stores 
them  into  an  intermediate  RAM  buffer,  checks  for  any  command  abort  status,  and 
dispatches  processing  to  the  specific  routine  designed  to  handle  one  of  the 
ten  different  command  types. 


7.1.6  BFN 

Not  examined. 
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7.1.7 


HRAM 


Processing  is  performed  each  CPU  execute  cycle  and  writes  certain 
RAM  parameters  to  the  HRAM.  Attitude  control  processing  sets  a  control  word 
as  new  RAM  parameters  are  computed  which  require  writing  to  HRAM.  This 
control  word  is  used  at  the  next  CPU  executive  cycle  to  update  only  those  HRAM 
w ords  required.  CPU  time  and  power  is  saved  by  not  writing  all  values  to  HRAM 
each  CPU  execution  cycle. 


7.1.8  Traps 

Four  trap  types  are  processed:  CPU  odd-address,  CPU  illegal 
instruction,  port  time-out,  and  software  triggered.  Traps  are  special 
hardware  interrupt  vectors.  The  odd-address  trap  occurs  when  the  CPU  executes 
from  an  odd  memory  address  for  some  reason  (hardware  fault,  bad  programming). 
The  ROM  program  cannot  decide  what  address  value  should  be  used,  therefore  a 
software  status  bit  is  set  and  the  CPU  is  halted  (' halt ' instruction  terminates 
CPU/ROM  power  strobe).  The  software  status  bit  is  then  recognized  by 
subsequent  ci rcumventive  processing  at  the  next  CPU  execute  cycle  (see 
circumventive  processing,  above).  The  illegal  instruction  trap  occurs  when 
the  CPU  tries  to  decode  a  word  from  memory  which  is  not  a  defined,  machine 
operation  code.  The  processing  sets  a  software  status  bit  and  the  CPU  is 
halted.  The  software  status  bit  is  then  recognized  by  subsequent, 
circumventive  processing.  Time-out  traps  occur  when  addressed  peripheral 
devices  do  not  respond  within  several  microseconds.  This  could  occur  if  a 
nonexistent  port  of  memory  is  addressed.  Trap  processing  sets  a  software 
status  flag,  which  goes  to  telemetry,  and  returns  to  the  interrupted  program. 
Software  triggered  traps  occur  when  a  'trap'  instruction  is  executed  in  the 
presence  of  'integer  overflow'  or  'divide  by  zero'  conditions.  This  is  used 
in  double  precision  subroutines  to  detect  computational  errors.  Recovery 
processing  consists  of  setting  a  software  status  bit  and  returning  to  the 
interrupted  routine  where  the  faulty  calculation  is  set  to  zero. 


7.1.9  RAM  Patch 

'RAM  patching'  uses  the  redundant  RAM.  It  allows  changing  the  ROM 
program  flow  by  storing  into  the  redundant  RAM  a  modification  which  has  been 
previously  checked  out  and  ground  verified.  At  the  time  that  the  ROM  program 
is  installed,  'hooks'  ('breakpoint  trap'  (bpt)  instructions)  are  interleaved 
at  preselected  locations  throughout  the  ROM  software  to  facilitate  later  RAM 
patching.  All  patches  contain  a  patch  table  which  is  stored  in  to  reserved 
RAM  locations.  The  patch  table  contains:  old  program  location  for  bpt 
instruction,  entry  point  location  for  the  uplinked  patch,  and  the  new  ROM 
program  location  return  point.  Multiple  patches  can  be  in  effect,  using  the 
patch  table.  Execution  of  the  ROM  bpt  instructions  causes  trap  interrupt 
processing.  This  processing  checks  for  the  presence  of  the  correct  ground 
commanded  enable  and  execute  discrete  commands,  and  the  patch  table  located  in 
the  proper  place  in  the  RAM.  If  all  is  enabled  and  ready,  the  patch  is 
executed,  after  which  the  program  flow  returns  to  the  ROM  program.  Patches 
can  be  used  up  to  the  limit  of  the  redundant  IK  RAM's  ability  to  hold  them  and 
the  limit  in  running  time  of  the  ACS  program  that  can  be  tolerated. 
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